SameSite=None cookie (ARCH4136)

Key java.security.samesite-none-cookie · Severity warning · Category security · CWE CWE-1275

Browsers accept SameSite=None cookies only with the Secure flag; without it the cookie is rejected and the CSRF posture weakens.

Incorrect

ResponseCookie c = ResponseCookie.from("session", token)
    .sameSite("None")
    .build();

Correct

ResponseCookie c = ResponseCookie.from("session", token)
    .sameSite("None")
    .secure(true)
    .build();

Fix

Add the Secure flag to every SameSite=None cookie; prefer SameSite=Lax when cross-site use is not required.