10054-2—Cookie with SameSite Attribute None

PUBLISHEDsecurity alertLow

Passive

Metadata

Alert ID:: 10054-2
Risk:: Low
Type:: Passive
CWE:: CWE-1275Sensitive Cookie with Improper SameSite Attribute

摘要

A cookie has been set with its SameSite attribute set to “none”, which means that the cookie can be sent as a result of a ‘cross-site’ request. The SameSite attribute is an effective counter measure to cross-site request forgery, cross-site script inclusion, and timing attacks.

解决方案

Ensure that the SameSite attribute is set to either 'lax' or ideally 'strict' for all cookies.

参考

browse all alerts