Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
The getSameSite() method hardcodes a null return value, dropping the configured SameSite attribute from HTTP response cookies and leaving applications vulnerable to CSRF and cross-site cookie leaks.
The application sets a cookie using `send_header` without enforcing 'HttpOnly' or 'SameSite' attributes. This can leave the application vulnerable to Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF). Always ensure sensitive cookies are protected with 'HttpOnly', 'SameSite', and 'Secure' flags.
A sensitive cookie is being set without the `SameSite` attribute. Without `SameSite=Strict` or `Lax`, the browser may send this cookie in cross-origin requests, exposing the application to Cross-Site Request Forgery (CSRF) or authentication bypasses.
Setting a session cookie via `send_header` without specifying the `SameSite` attribute can expose the application to Cross-Site Request Forgery (CSRF) and other cross-origin attacks. Browsers may send the associated cookie in cross-site requests. Explicitly include `SameSite=Lax` or `SameSite=Strict` in the cookie string.
A cookie is set via `res.cookie` without specifying the `sameSite` attribute. Without `sameSite` correctly configured to 'lax' or 'strict', the cookie will be sent in third-party contexts, exposing the application to Cross-Site Request Forgery (CSRF). Always supply an options object configuring `{ sameSite: 'lax' }` or stricter, along with 'httpOnly' where a
'Default session middleware settings: `sameSite` attribute is not configured to strict or lax. These configurations provides protection against Cross Site Request Forgery attacks.'
JSCWE-1275
