SameSite=None cookie (ARCH7136)

Key php.security.samesite-none-cookie · Severity warning · Category security · CWE CWE-1275

Cookies set with SameSite=None but without Secure are rejected by modern browsers and weaken CSRF posture. If SameSite=None is used, the cookie must also be Secure.

Incorrect

<?php
setcookie('session', $id, [
    'samesite' => 'None',
    'httponly' => true,
]);

Correct

<?php
setcookie('session', $id, [
    'samesite' => 'Lax',
    'secure' => true,
    'httponly' => true,
]);

Fix

Prefer SameSite=Lax; if None is required, add the Secure attribute to the cookie.