v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
MEDIUM AI PREVALENCE: MEDIUM auth.csharp.cookie.samesite-none

A cookie is set to SameSite = SameSiteMode.None, which removes the SameSite defense and sends the cookie on cross-site requests.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

For an authentication or session cookie this re-opens the CSRF surface that Lax/Strict closes, and None is only safe when the cookie is also marked Secure (browsers reject SameSite=None without it) (CWE-1275). This is a common AI-generated change made to get a cookie flowing in an embedded/cross-site scenario.

Leave auth/session cookies at SameSiteMode.Lax (the framework default) or SameSiteMode.Strict. Only use SameSiteMode.None for a genuinely cross-site cookie, and when you do, also set Secure = true and rely on anti-forgery tokens for CSRF protection.

VULNERABLE
vulnerable.cs
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Authentication.Cookies;

public class CookieConfig
{
    public CookieOptions BuildInitializer()
    {
        return new CookieOptions
        {
            HttpOnly = true,
            // ruleid: auth.csharp.cookie.samesite-none
            SameSite = SameSiteMode.None,
        };
    }

    public void ConfigureAuthCookie(CookieAuthenticationOptions options)
    {
        // ruleid: auth.csharp.cookie.samesite-none
        options.Cookie.SameSite = SameSiteMode.None;
    }
}
SAFE
safe.cs
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Authentication.Cookies;

public class CookieConfig
{
    // Framework-default-aligned SameSite values keep the CSRF defense.
    public CookieOptions BuildInitializer()
    {
        return new CookieOptions
        {
            HttpOnly = true,
            SameSite = SameSiteMode.Lax,
        };
    }

    public void ConfigureAuthCookie(CookieAuthenticationOptions options)
    {
        options.Cookie.SameSite = SameSiteMode.Strict;
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.csharp.cookie.samesite-none -- <reason>

References

https://learn.microsoft.com/aspnet/core/security/samesite ↗https://cwe.mitre.org/data/definitions/1275.html ↗