v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
LOW AI PREVALENCE: MEDIUM auth.cookie.no-samesite

A session/auth cookie is being set WITHOUT the SameSite attribute.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

Modern browsers default to Lax, but explicit is better, and APIs that legitimately need cross-site usage should consciously opt into None (with Secure), not silently inherit whatever the browser does today.

For most auth flows, SameSite=Strict is the right answer; for OAuth callbacks, SameSite=Lax is required.

VULNERABLE
vulnerable.ts
import type { Response } from 'express';

export function loginBad(res: Response, token: string) {
  // ruleid: auth.cookie.no-samesite
  res.cookie('session', token, { httpOnly: true, secure: true });
}

export function loginBad2(res: Response, jwt: string) {
  // ruleid: auth.cookie.no-samesite
  res.cookie('refresh_token', jwt, { httpOnly: true });
}

export function loginBad3(res: Response, token: string) {
  // ruleid: auth.cookie.no-samesite -- SameSite=None without Secure
  res.cookie('session', token, { httpOnly: true, sameSite: 'none' });
}
SAFE
safe.ts
import type { Response } from 'express';

// ok: auth.cookie.no-samesite
export function loginGood(res: Response, token: string) {
  res.cookie('session', token, {
    httpOnly: true,
    secure: true,
    sameSite: 'strict',
  });
}

// ok: auth.cookie.no-samesite -- OAuth flow needs Lax
export function setOauthCookie(res: Response, state: string) {
  res.cookie('oauth_state', state, {
    httpOnly: true,
    secure: true,
    sameSite: 'lax',
  });
}

// ok: auth.cookie.no-samesite -- SameSite=None is valid WITH Secure (legit cross-site)
export function setCrossSiteCookie(res: Response, token: string) {
  res.cookie('session', token, {
    httpOnly: true,
    secure: true,
    sameSite: 'none',
  });
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.cookie.no-samesite -- <reason>

References

https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-13#section-4.1.2.7 ↗