SameSite=None Cookie (ARCH5136)

Key go.security.samesite-none-cookie · Severity warning · Category security · CWE CWE-1275

Browsers only accept SameSite=None cookies when Secure is also set; without it the cookie is rejected and CSRF posture weakens.

Incorrect

http.SetCookie(w, &http.Cookie{
  Name:     "session",
  Value:    token,
  SameSite: http.SameSiteNoneMode,
})

Correct

http.SetCookie(w, &http.Cookie{
  Name:     "session",
  Value:    token,
  SameSite: http.SameSiteNoneMode,
  Secure:   true,
  HttpOnly: true,
})

Fix

Set Secure: true on any cookie using SameSite=None, or prefer SameSiteLaxMode when cross-site is not required.