How to set SameSite on a cookie
SameSite decides whether the browser sends the cookie on requests that start on other sites. SameSite=Lax stops most CSRF attacks without breaking normal sign-in.
How to fix it
Your web server
Where: wherever you set the cookie (app framework session config, or Set-Cookie header)
Add the SameSite=Lax attribute when you set the cookie. Examples:
Set-Cookie: session=...; Secure; HttpOnly; SameSite=Lax
Express: res.cookie('session', v, { secure: true, httpOnly: true, sameSite: 'lax' })
Django: SESSION_COOKIE_SECURE = True / _HTTPONLY = True / _SAMESITE = 'Lax'
PHP: session_set_cookie_params(['secure'=>true,'httponly'=>true,'samesite'=>'Lax'])Set SameSite=Lax on session/auth cookies so the cookie isn't sent on cross-site requests (CSRF defence).
How to confirm: Re-scan — the cookie-flag finding should clear.
Not sure your site needs this fix? A scan checks this and dozens of other things and shows what yours is missing.
Scan your site free