A session cookie is set without a valid SameSite attribute. The attribute tells the browser not to send the cookie along with requests that were started by another site, which is the main browser side defense against cross-site request forgery (CSRF).

Modern browsers treat a missing attribute as Lax, but older browsers, some embedded browsers and a number of clients do not, and they attach the cookie to every cross-site request. Relying on the default also makes the protection invisible in the application's own configuration.

1. Set SameSite=Lax on session cookies, or SameSite=Strict when the application does not need to be entered by following links from other sites.

2. Keep anti-CSRF tokens for state changing requests. SameSite is an additional layer, not a replacement.

3. Set the attribute in the framework's session configuration rather than in individual responses, so that it applies to every cookie.

• CWE-1275: Sensitive Cookie with Improper SameSite Attribute
• OWASP Cross-Site Request Forgery Prevention Cheat Sheet