SameSite=None cookie (ARCH337)

Key dotnet.security.samesite-none-cookie · Severity warning · Category security · CWE CWE-1275

SameSite=None cookies are sent on cross-site requests and widen the CSRF attack surface. Unless a genuine cross-site scenario requires it, this is an unnecessary risk.

Incorrect

Response.Cookies.Append("session", token, new CookieOptions
{
    SameSite = SameSiteMode.None,
    Secure = true
});

Correct

Response.Cookies.Append("session", token, new CookieOptions
{
    SameSite = SameSiteMode.Lax,
    Secure = true,
    HttpOnly = true
});

Fix

Use SameSite=Lax (or Strict) unless there is an explicit cross-site requirement; if None is required, always pair it with Secure and document the justification.