Rule Definition
The SameSite attribute controls how cookies are sent for cross-domain requests. This attribute may have three values: 'Lax', 'Strict', or 'None'. If the 'None' value is used, a website may create a cross-domain POST HTTP request to another website, and the browser automatically adds cookies to this request. This may lead to Cross-Site-Request-Forgery (CSRF) attacks if there are no additional protections in place (such as Anti-CSRF tokens).

Remediation
Always set SameSite to 'Lax' or 'Strict' when creating a cookie

Violation Code Sample

// SAMPLE 1

Cookie cookie = new Cookie("userName", userName);  // VIOLATION
cookie.setSecure(true);
cookie.setHttpOnly(true);
// Missing SameSite Attribute
response.addCookie(cookie);

// SAMPLE 2

response.addHeader("Set-Cookie", "userName=" + userName + "; Secure; HttpOnly, SameSite=None");  // VIOLATION

Fixed Code Sample

// REMEDIATION 1 (only for a jakarta.servlet.http.Cookie)

Cookie cookie = new Cookie("userName", userName);  // FIXED
cookie.setSecure(true);
cookie.setHttpOnly(true);
cookie.setAttribute("SameSite", "Lax");            // SameSite Attribute
response.addCookie(cookie);

// REMEDIATION 2

response.addHeader("Set-Cookie", "userName=" + userName + "; Secure; HttpOnly, SameSite=Lax");  // FIXED

CWE-1275: Sensitive Cookie with Improper SameSite Attribute https://cwe.mitre.org/data/definitions/1275.html OWASP Top Ten 2021 Category A01:2021 – Broken Access Control https://owasp.org/Top10/A01_2021-Broken_Access_Control/