SameSite=None cookie without Secure (ARCH2136)
Dieser Inhalt ist noch nicht in deiner Sprache verfügbar.
Key python.security.samesite-none-cookie · Severity warning · Category security · CWE CWE-1275
SameSite=None cookies without the Secure attribute are rejected by browsers and weaken the CSRF posture. Set Secure together with SameSite=None.
Incorrect
Section titled “Incorrect”def set_cookie(resp, token): resp.set_cookie("session", token, samesite="None")Correct
Section titled “Correct”def set_cookie(resp, token): resp.set_cookie("session", token, samesite="None", secure=True)Always mark the cookie Secure when using SameSite=None.