close

DEV Community

Bryan Rafael
Bryan Rafael

Posted on

SameSite cookies and CSRF: what auditors actually check

#cybersecurity #webdev #security

CSRF is mostly dead — thanks to SameSite. But "mostly" carries a lot of weight in an audit report: cookies missing SameSite, or set to None without Secure, are the most common session findings.

SameSite, quickly

Value Cookie sent on Typical use
Lax Top-level navigations (and same-site) — NOT on subresource requests from other sites Default for most apps ✓
Strict Same-site requests only Where you never need external links to carry state
None Always (ignores site) — MUST have Secure Cross-site embed/subdomain auth flows (legacy)

What fails an audit

  1. Cookie without SameSite at all → cross-site state still possible
  2. SameSite=None without Secure → browser rejects the cookie entirely (and the app breaks silently without anyone noticing)
  3. SameSite=None used defensively for everything → CSRF surface recreated
  4. CSRF tokens missing on mutation endpoints that rely only on SameSite (defense-in-depth check)

The passive check 

curl -sI https://your-site.com | grep -i set-cookie
Enter fullscreen mode Exit fullscreen mode

reconpp reads every Set-Cookie and reports missing/incorrect flags (Secure, HttpOnly, SameSite) with the exact fix per cookie:

pip install git+https://github.com/bryanrafaelbueno/reconpp
reconpp -u https://your-site.com -f md -o report.md
Enter fullscreen mode Exit fullscreen mode

Recommendation

  • SameSite=Lax by default; Strict for banking-type apps
  • Keep anti-CSRF tokens anyway (defense in depth)
  • Never None unless there's a verified cross-site need

The 70+ point checklist (sessions, headers, API, auth, CI/CD) is in the pt-BR ebook — free sample at the store:

Top comments (0)