SameSite=None cookie (ARCH3136)

Key typescript.security.samesite-none-cookie · Severity warning · Category security · CWE CWE-1275

Setting a cookie with SameSite=None but without Secure makes browsers reject it and weakens the CSRF posture.

Incorrect

res.cookie("session", token, {
  sameSite: "none",
  // secure missing
});

Correct

res.cookie("session", token, {
  sameSite: "none",
  secure: true,
  httpOnly: true,
});

Fix

Always add the Secure attribute when using SameSite=None; otherwise prefer Lax.