Rule Definition
The SameSite attribute controls how cookies are sent for cross-domain requests. This attribute may have three values: 'Lax', 'Strict', or 'None'. If the 'None' value is used, a website may create a cross-domain POST HTTP request to another website, and the browser automatically adds cookies to this request. This may lead to Cross-Site-Request-Forgery (CSRF) attacks if there are no additional protections in place (such as Anti-CSRF tokens).

Remediation
Always set SameSite to 'Lax' or 'Strict' when creating a cookie

Violation Code Sample

$arr_cookie_options = array (
    'expires' => time() + 60*60*24*30,
    'path' => '/',
    'domain' => '.example.com',
    'secure' => true,
    'httponly' => true
    // Missing option 'samesite'
);
setcookie("user", "John Doe", $arr_cookie_options);  // VIOLATION

Fixed Code Sample

$arr_cookie_options = array (
    'expires' => time() + 60*60*24*30,
    'path' => '/',
    'domain' => '.example.com',
    'secure' => true,
    'httponly' => true,
    'samesite' => 'Lax'                              // SameSite set to 'Lax'
);
setcookie("user", "John Doe", $arr_cookie_options);  // FIXED

CWE-1275: Sensitive Cookie with Improper SameSite Attribute https://cwe.mitre.org/data/definitions/1275.html OWASP Top Ten 2021 Category A01:2021 – Broken Access Control https://owasp.org/Top10/A01_2021-Broken_Access_Control/