CWE-1275 — Sensitive Cookie with Improper SameSite Attribute
CWE-1275: Sensitive Cookie with Improper SameSite Attribute
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Variant |
| Status | Incomplete |
| Likelihood of exploit | Medium |
Description
The SameSite attribute for sensitive cookies is not set, or an insecure value is used.
The SameSite attribute controls how cookies are sent for cross-domain requests. This attribute may have three values: 'Lax', 'Strict', or 'None'. If the 'None' value is used, a website may create a cross-domain POST HTTP request to another website, and the browser automatically adds cookies to this request. This may lead to Cross-Site-Request-Forgery (CSRF) attacks if there are no additional protections in place (such as Anti-CSRF tokens).
Common consequences
- Confidentiality, Integrity, Non-Repudiation, Access Control: Modify Application Data
Mitigations
Implementation — Set the SameSite attribute of a sensitive cookie to 'Lax' or 'Strict'. This instructs the browser to apply this cookie only to same-domain requests, which provides a good Defense in Depth against CSRF attacks. When the 'Lax' value is in use, cookies are also sent for top-level cross-domain navigation via HTTP GET, HEAD, OPTIONS, and TRACE methods, but not for other HTTP methods that are more like to cause side-effects of state mutation.
References
- CWE page: https://cwe.mitre.org/data/definitions/1275.html
- CWE list: https://cwe.mitre.org/data/index.html