10054-3—Cookie with Invalid SameSite Attribute

PUBLISHEDsecurity alertLow

Passive

Metadata

Alert ID:: 10054-3
Risk:: Low
Type:: Passive
CWE:: CWE-1275Sensitive Cookie with Improper SameSite Attribute

摘要

A cookie has been set with an invalid SameSite attribute value, which means that the cookie can be sent as a result of a ‘cross-site’ request. The SameSite attribute is an effective counter measure to cross-site request forgery, cross-site script inclusion, and timing attacks.

解决方案

Ensure that the SameSite attribute is set to either 'lax' or ideally 'strict' for all cookies.

参考

browse all alerts