SameSite=None cookie (ARCH4136)
Dieser Inhalt ist noch nicht in deiner Sprache verfügbar.
Key java.security.samesite-none-cookie · Severity warning · Category security · CWE CWE-1275
Browsers accept SameSite=None cookies only with the Secure flag; without it the cookie is rejected and the CSRF posture weakens.
Incorrect
Section titled “Incorrect”ResponseCookie c = ResponseCookie.from("session", token) .sameSite("None") .build();Correct
Section titled “Correct”ResponseCookie c = ResponseCookie.from("session", token) .sameSite("None") .secure(true) .build();Add the Secure flag to every SameSite=None cookie; prefer SameSite=Lax when cross-site use is not required.