3.4.3 Cookie-based session tokens utilize the ‘SameSite’ attribute¶
Verify that cookie-based session tokens utilize the ‘SameSite’ attribute to limit exposure to cross-site request forgery attacks. (C6)
| Level 1 | X |
| Level 2 | X |
| Level 3 | X |
| CWE | NIST |
|---|---|
| 16 | 7.1.1 |
PHP¶
Since PHP 7.3 you can set the cookie_samesite_ option in the INI configuration. Set it to lax or strict
Symfony¶
The cookie_samesite configuration option should be set to either lax or strict.
Laravel¶
In config/session.php you can set the option same_site to either lax or strict