SameSite Cookie Attribute
debt(d5/e2/b3/t6)
Closest to 'specialist tool catches' (d5), semgrep and owasp-zap can flag missing SameSite attributes or SameSite=None without Secure, but it won't show up in normal compilation or default linting.
Closest to 'one-line patch' (e1) but slightly higher because cookie settings may be set in multiple places (session_set_cookie_params, setcookie calls, framework config), so e2 reflects a small parameterised fix across a handful of call sites.
Closest to 'localised tax' (b3), applies to web context cookie configuration — affects authentication/session layer but doesn't reshape the system architecture.
Closest to 'serious trap' (t7), the misconception that Lax fully replaces CSRF tokens is widespread and dangerous, plus the SameSite=None+Secure requirement contradicts intuition — developers consistently guess wrong about coverage.
Also Known As
TL;DR
Explanation
SameSite has three values: Strict (cookie never sent with cross-site requests — breaks OAuth flows), Lax (cookie sent on top-level navigations like link clicks, not on embedded requests — default in modern browsers), and None (cookie sent everywhere — requires Secure attribute). SameSite=Lax is the practical CSRF defence for most session cookies. In PHP, set it via session_set_cookie_params(['samesite' => 'Lax', 'secure' => true, 'httponly' => true]) or in the Set-Cookie header via setcookie().
Common Misconception
Why It Matters
Common Mistakes
- Setting SameSite=None without also setting the Secure flag — browsers reject this combination.
- Assuming SameSite=Lax fully protects against CSRF — top-level GET navigations still send the cookie.
- Not setting SameSite at all and relying on the browser default, which varies across browser versions.
- Setting SameSite=Strict on cookies needed for third-party embeds, breaking legitimate cross-site access.
Code Examples
session_set_cookie_params(['httponly' => true]); // missing SameSite & Securesession_set_cookie_params(['httponly' => true, 'secure' => true, 'samesite' => 'Lax']);