Kingdom: Security Features

Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

Cookie Security: Overly Permissive SameSite Attribute

Abstract

The SameSite parameter on session cookies is not set to Strict.

Explanation

Browsers automatically append cookies to every HTTP request made to the site that sets the cookie. Cookies might store sensitive data such as session ID and authorization token or site data that is shared between different requests to the same site during a session. An attacker can perform an impersonation attack by generating a request to the authenticated site from a third-party site page loaded on the client machine because the browser automatically appended the cookie to the request.

The SameSite parameter limits the scope of the cookie so that it is only attached to a request if the request is generated from first-party or same-site context. This helps to protect cookies from Cross-Site Request Forgery (CSRF) attacks. The SameSite parameter can have the following three values:

- Strict: When set to Strict, cookies are only sent along with requests upon top-level navigation.
- Lax: When set to Lax, cookies are sent with top-level navigation from the same host as well as GET requests originated to the host from third-party sites. For example, suppose a third-party site has either iframe or href tags that link to the host site. If a user follows the link, the request will include the cookie.
- None: Cookies are sent in all requests made to the site within the path and domain scope set for the cookie. Requests generated due to form submissions using the POST method are also allowed to send cookies with the request.

Example 1: The following code sets the SameSite parameter to Lax for session cookies.


...
Cookie cookie = new Cookie('name', 'Foo', path, -1, true, 'Lax');
...

References

[1] HTTP State Management Mechanism Internet Engineering Task Force

[2] SameSite Browser Compatibility Can I Use

[3] Standards Mapping - CIS Azure Kubernetes Service Benchmark 2

[4] Standards Mapping - CIS Microsoft Azure Foundations Benchmark complete

[5] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 1

[6] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1

[7] Standards Mapping - CIS Google Kubernetes Engine Benchmark integrity

[8] Standards Mapping - CIS Kubernetes Benchmark complete

[9] Standards Mapping - Common Weakness Enumeration CWE ID 352

[10] Standards Mapping - Common Weakness Enumeration Top 25 2019 [9] CWE ID 352

[11] Standards Mapping - Common Weakness Enumeration Top 25 2020 [9] CWE ID 352

[12] Standards Mapping - Common Weakness Enumeration Top 25 2021 [9] CWE ID 352

[13] Standards Mapping - Common Weakness Enumeration Top 25 2022 [9] CWE ID 352

[14] Standards Mapping - Common Weakness Enumeration Top 25 2023 [9] CWE ID 352

[15] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001310, CCI-001941, CCI-001942

[16] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[17] Standards Mapping - NIST Special Publication 800-53 Revision 4 SC-23 Session Authenticity (P1)

[18] Standards Mapping - NIST Special Publication 800-53 Revision 5 SC-23 Session Authenticity

[19] Standards Mapping - OWASP Top 10 2007 A5 Cross Site Request Forgery (CSRF)

[20] Standards Mapping - OWASP Top 10 2010 A5 Cross-Site Request Forgery (CSRF)

[21] Standards Mapping - OWASP Top 10 2013 A8 Cross-Site Request Forgery (CSRF)

[22] Standards Mapping - OWASP Top 10 2021 A01 Broken Access Control

[23] Standards Mapping - OWASP Application Security Verification Standard 4.0 3.4.3 Cookie-based Session Management (L1 L2 L3)

[24] Standards Mapping - OWASP Mobile 2014 M5 Poor Authorization and Authentication

[25] Standards Mapping - OWASP Mobile 2024 M3 Insecure Authentication/Authorization

[26] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.5.5

[27] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.9

[28] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.9

[29] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.9

[30] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.9

[31] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.9

[32] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[33] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 5.4 - Authentication and Access Control

[34] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 5.4 - Authentication and Access Control

[35] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 5.4 - Authentication and Access Control, Control Objective C.2.3 - Web Software Access Controls

[36] Standards Mapping - SANS Top 25 2009 Insecure Interaction - CWE ID 352

[37] Standards Mapping - SANS Top 25 2010 Insecure Interaction - CWE ID 352

[38] Standards Mapping - SANS Top 25 2011 Insecure Interaction - CWE ID 352

[39] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3585 CAT II

[40] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3585 CAT II

[41] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3585 CAT II

[42] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3585 CAT II

[43] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3585 CAT II

[44] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3585 CAT II

[45] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3585 CAT II

[46] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[47] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[48] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[49] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[50] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[51] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[52] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[53] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[54] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[55] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[56] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[57] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[58] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[59] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-001620 CAT II, APSC-DV-001630 CAT II, APSC-DV-002500 CAT II

[60] Standards Mapping - Web Application Security Consortium Version 2.00 Cross-Site Request Forgery (WASC-09)

[61] Standards Mapping - Web Application Security Consortium 24 + 2 Cross-Site Request Forgery

desc.semantic.apex.cookie_security_overly_permissive_samesite_attribute

Abstract

The SameSite attribute on session cookies is not set to Strict.

Explanation

The SameSite attribute protects cookies from attacks such as Cross-Site Request Forgery (CSRF). Session cookies represent a user to the site so that the user can perform authorized actions. However, the browser automatically sends the cookies with the request and therefore users and web sites implicitly trust the browser for authorization. An attacker can misuse this trust and make a request to the site on behalf of the user by embedding links inside the href and src attribute of tags such as link and iframe in third-party site pages that an attacker controls. If an attacker is able to lure an unsuspecting user to the third-party site that they control, the attacker can make requests that automatically include the session cookie authorizing the user, effectively authorizing the attacker as if they were the user.
Set the value of the SameSite attribute to Strict in session cookies. This restricts the browser to append cookies only to requests that are either top-level navigation or originate from the same site. Requests that originate from third-party sites via links in various tags such as iframe, img, and form do not have these cookies and therefore prevent the site from taking action that the user might not have authorized.

Example 1: The following code sets the value of the SameSite attribute to Lax for session cookies.


    ...
    CookieOptions opt = new CookieOptions()
    {
        SameSite = SameSiteMode.Lax;
    };
    context.Response.Cookies.Append("name", "Foo", opt);
    ...