CVE-2024-28195: Missing Samesite On Express Cookie
A cookie is set via `res.cookie` without specifying the `sameSite` attribute. Without `sameSite` correctly configured to 'lax' or 'strict', the cookie will be sent in third-party contexts, exposing the application to Cross-Site Request Forgery (CSRF). Always supply an options object configuring `{ sameSite: 'lax' }` or stricter, along with 'httpOnly' where a
greprules fetch cve-2024-28195-missing-samesite-on-express-cookie --engine opengrepDescription
A cookie is set via `res.cookie` without specifying the `sameSite` attribute. Without `sameSite` correctly configured to 'lax' or 'strict', the cookie will be sent in third-party contexts, exposing the application to Cross-Site Request Forgery (CSRF). Always supply an options object configuring `{ sameSite: 'lax' }` or stricter, along with 'httpOnly' where a
Detection target
Not provided
Recommended fix
Not provided
False-positive notes
Not provided
Community feedback
Sign in to report false positives, mark this rule useful, or suggest metadata improvements.