CWE-1275Sensitive Cookie with Improper SameSite Attribute

Description

The SameSite attribute for sensitive cookies is not set, or an insecure value is used.

Common consequences

• Confidentiality,Integrity,Non-Repudiation,Access Control→Modify Application Data
  [object Object]

Potential mitigations

• Implementation
  Set the SameSite attribute of a sensitive cookie to "Lax" or "Strict". This instructs the browser to apply this cookie only to same-domain requests, which provides a good Defense in Depth against CSRF attacks. When the "Lax" value is in use, cookies are also sent for top-level cross-domain navigation via HTTP GET, HEAD, OPTIONS, and TRACE methods, but not for other HTTP methods that are more likel

Related CWEs

Recent CVEs classified under this CWE