A session cookie declares SameSite=None but is not marked Secure. SameSite=None allows the browser to send the cookie in every cross-site context, and the specification requires it to be combined with Secure. Current browsers reject such a cookie outright, which breaks the feature that needed it. Browsers that still accept it expose the cookie on unencrypted connections as well.

1. Add the Secure attribute to every cookie that uses SameSite=None, and serve the site over HTTPS only.

2. Use SameSite=Lax or Strict when cross-site delivery of the cookie is not required.

• CWE-1275: Sensitive Cookie with Improper SameSite Attribute
• MDN - Set-Cookie: SameSite