SameSite None Without Secure

A cookie is written through a PHP web framework (Symfony, Zend, Laminas, …​) or the native setcookie options array with samesite='None' but without the secure flag enabled. The cross-site policy is set to None while secure is left false or omitted.

SameSite=None tells the browser to send the cookie on cross-site requests, re-enabling the exact behaviour that the SameSite mechanism exists to restrain. Modern browsers therefore only accept a SameSite=None cookie when it is also marked Secure; a cookie that is None without Secure is either rejected outright or, on older clients, transmitted over plain HTTP.

Omitting secure on a cross-site cookie exposes it to interception over insecure transport and re-opens the CSRF surface that SameSite was meant to close. Session and authentication cookies configured this way can be leaked or replayed.

When a cookie must be sent cross-site (samesite='None'), always mark it secure=true so it is only transmitted over HTTPS. If the cookie does not need to be sent cross-site, prefer samesite='Lax' or samesite='Strict'.