Lack of SameSite cookie attribute

Cookie security attributes are specific attributes applied to HTTP cookies to enhance their security. These
attributes help to protect user data and mitigate various security risks.

Implication and Impact :


The “SameSite” attribute allows declaring whether the cookie should be restricted to a first-party or samesite
context, which means that all the cookies without the “SameSite” attribute would be added to any
requests initiated to any other website. This allows attackers to abuse sessions belonging to an authorized
user and exploit Cross-Site Request Forgery (CSRF) attacks. Since this issue does not pose a direct threat
now, its severity has been decreased to informational.