logo

Sensitive Cookie with Improper SameSite Attribute

Incomplete Variant
Structure: Simple
Description

This vulnerability occurs when a sensitive cookie does not have a secure SameSite attribute configured, leaving it exposed to cross-site request forgery (CSRF) attacks.

Extended Description

The SameSite cookie attribute is a critical browser security feature that controls whether a cookie is sent with cross-site requests. It has three possible values: 'Strict' (most secure, never sent cross-site), 'Lax' (sent with safe top-level navigation like links), and 'None' (always sent, requiring the Secure flag). When this attribute is omitted or set insecurely for sensitive cookies—like session or authentication tokens—those credentials can be automatically included in malicious cross-site requests, bypassing the browser's default protections. This creates a direct path for CSRF attacks, where an attacker's site can trigger authenticated actions on the target site without the user's consent. While other defenses like anti-CSRF tokens are important, properly configuring SameSite provides a fundamental, browser-enforced layer of security. For maximum protection, set sensitive cookies to 'Strict' or 'Lax' unless a specific cross-site functionality requires 'None', in which case the Secure flag is mandatory.
Common Consequences 1
Scope: ConfidentialityIntegrityNon-RepudiationAccess Control

Impact: Modify Application Data

If the website does not impose additional defense against CSRF attacks, failing to use the 'Lax' or 'Strict' values could increase the risk of exposure to CSRF attacks. The likelihood of the integrity breach is Low because a successful attack does not only depend on an insecure SameSite attribute. In order to perform a CSRF attack there are many conditions that must be met, such as the lack of CSRF tokens, no confirmations for sensitive actions on the website, a "simple" "Content-Type" header in the HTTP request and many more.
Detection Methods 1
Automated Static AnalysisHigh
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Potential Mitigations 1
Phase: Implementation
Set the SameSite attribute of a sensitive cookie to 'Lax' or 'Strict'. This instructs the browser to apply this cookie only to same-domain requests, which provides a good Defense in Depth against CSRF attacks. When the 'Lax' value is in use, cookies are also sent for top-level cross-domain navigation via HTTP GET, HEAD, OPTIONS, and TRACE methods, but not for other HTTP methods that are more like to cause side-effects of state mutation.

Effectiveness: High
Demonstrative Examples 1
In this example, a cookie is used to store a session ID for a client's interaction with a website. The snippet of code below establishes a new cookie to hold the sessionID.

Code Example:

Bad
JavaScript

let sessionId = generateSessionId() let cookieOptions = { domain: 'example.com' } response.cookie('sessionid', sessionId, cookieOptions)

Since the sameSite attribute is not specified, the cookie will be sent to the website with each request made by the client. An attacker can potentially perform a CSRF attack by using the following malicious page:

Code Example:

Attack
HTML
html
When the client visits this malicious web page, it submits a '/setEmail' POST HTTP request to the vulnerable website. Since the browser automatically appends the 'sessionid' cookie to the request, the website automatically performs a 'setEmail' action on behalf of the client.
To mitigate the risk, use the sameSite attribute of the 'sessionid' cookie set to 'Strict'.

Code Example:

Good
JavaScript

let sessionId = generateSessionId() let cookieOptions = { domain: 'example.com', sameSite: 'Strict' } response.cookie('sessionid', sessionId, cookieOptions)
Observed Examples 1
CVE-2022-24045Web application for a room automation system has client-side JavaScript that sets a sensitive cookie without the SameSite security attribute, allowing the cookie to be sniffed
References 3
SameSite attribute specification draft
M. West and M. Goodwin
06-04-2016
https://datatracker.ietf.org/doc/html/draft-west-first-party-cookies-07(2023-04-07)
ID: REF-1104
SameSite attribute description on MDN Web Docs
Mozilla
20-06-2020
https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#samesitesamesite-value(2025-08-04)
ID: REF-1105
Chromium support for SameSite attribute
The Chromium Projects
26-09-2019
https://www.chromium.org/updates/same-site/(2023-04-07)
ID: REF-1106
Likelihood of Exploit

Medium

Applicable Platforms
Languages:
Not Language-Specific : Undetermined
Technologies:
Web Based : Undetermined
Modes of Introduction
Implementation
Related Attack Patterns
Related Weaknesses
ChildOf: Improper Restriction of Communication Channel to Intended Endpoints (CWE-923)
CanPrecede: Cross-Site Request Forgery (CSRF) (CWE-352)