SameSite None Without Secure

ID

go.samesite_none_without_secure

Severity

low

Remediation Complexity

low

Remediation Risk

low

Remediation Effort

low

Resource

Misconfiguration

Language

Go

Tags

ASVS50:v3.4.3, CWE:1275, NIST.SP.800-53, OWASP:2025:A05, PCI-DSS:6.5.10

Description

A cookie is written through a Go web API (net/http, gin, fiber, gorilla, …​) with SameSite set to http.SameSiteNoneMode but without the Secure flag enabled. The cross-site policy is set to None while Secure is left false or omitted.

Rationale

SameSite=None tells the browser to send the cookie on cross-site requests, re-enabling the exact behaviour that the SameSite mechanism exists to restrain. Modern browsers therefore only accept a SameSite=None cookie when it is also marked Secure; a cookie that is None without Secure is either rejected outright or, on older clients, transmitted over plain HTTP.

Omitting Secure on a cross-site cookie exposes it to interception over insecure transport and re-opens the CSRF surface that SameSite was meant to close. Session and authentication cookies configured this way can be leaked or replayed.

// VULNERABLE: cross-site cookie is not marked Secure
http.SetCookie(w, &http.Cookie{
    Name:     "session",
    Value:    value,
    SameSite: http.SameSiteNoneMode,
    Secure:   false,
})

Remediation

When a cookie must be sent cross-site (SameSite: http.SameSiteNoneMode), always mark it Secure: true so it is only transmitted over HTTPS. If the cookie does not need to be sent cross-site, prefer http.SameSiteLaxMode or http.SameSiteStrictMode.

http.SetCookie(w, &http.Cookie{
    Name:     "session",
    Value:    value,
    SameSite: http.SameSiteNoneMode,
    Secure:   true, // FIXED
})

References