SameSite
A cookie attribute (Strict, Lax or None) that controls whether the browser sends the cookie with cross-site requests; a Lax cookie goes only with top-level navigations that use safe methods such as GET, and Chromium-based browsers treat cookies without the attribute as Lax. It reduces CSRF but does not replace origin checks, because same-site is broader than same-origin (CWE-1275).
- Identifiers
- CWE-1275: Improper SameSite cookie attribute
Covered in
Protect cookie-authenticated actions against CSRF
Make the server distinguish an intended action from a request another site caused the browser to send.
Session management: cookies, timeouts, rotation and revocation
Model authentication as transitions in server authority, set session cookies and timeouts to current NIST and OWASP values, and verify fixation prevention, expiry, reauthentication, revocation and stolen-cookie defenses.
Configure HTTP security headers from a tested baseline
Send the response headers that make browsers enforce HTTPS, run only your own scripts, refuse hostile framing and keep cookies on one host, then prove they appear on every kind of response.
Practice: CSRF lab: Protect an account change from a forged request · CSP builder lab: Build a strict Content-Security-Policy