SameSite=None cookie without Secure (ARCH6136)
Ce contenu n’est pas encore disponible dans votre langue.
Key ruby.security.samesite-none-cookie · Severity warning · Category security · CWE CWE-1275
Setting a cookie with SameSite=None but without the Secure attribute causes browsers to reject it and weakens CSRF posture.
Incorrect
Section titled “Incorrect”cookies[:session] = { value: token, same_site: :none }Correct
Section titled “Correct”cookies[:session] = { value: token, same_site: :none, secure: true }Always add Secure when using SameSite=None; prefer SameSite=Lax when possible.