SameSite=None Cookie (ARCH8136)
Key kotlin.security.samesite-none-cookie · Severity warning · Category security · CWE CWE-1275
Flags cookies sent with SameSite=None but no Secure flag - browsers reject them and cross-site CSRF posture weakens.
Incorrect
Section titled “Incorrect”ResponseCookie.from("session", id).sameSite("None").build()Correct
Section titled “Correct”ResponseCookie.from("session", id).sameSite("None").secure(true).httpOnly(true).build()Set secure = true on every SameSite=None cookie, or use Lax when cross-site is not required.