SameSite cookies and CSRF: what auditors actually check

CSRF is mostly dead — thanks to SameSite. But "mostly" carries a lot of weight in an audit report: cookies missing SameSite, or set to None without Secure, are the most common session findings.

SameSite, quickly

Value	Cookie sent on	Typical use
Lax	Top-level navigations (and same-site) — NOT on subresource requests from other sites	Default for most apps ✓
Strict	Same-site requests only	Where you never need external links to carry state
None	Always (ignores site) — MUST have Secure	Cross-site embed/subdomain auth flows (legacy)

What fails an audit

1. Cookie without SameSite at all → cross-site state still possible
2. SameSite=None without Secure → browser rejects the cookie entirely (and the app breaks silently without anyone noticing)
3. SameSite=None used defensively for everything → CSRF surface recreated
4. CSRF tokens missing on mutation endpoints that rely only on SameSite (defense-in-depth check)

The passive check

curl -sI https://your-site.com | grep -i set-cookie

reconpp reads every Set-Cookie and reports missing/incorrect flags (Secure, HttpOnly, SameSite) with the exact fix per cookie:

pip install git+https://github.com/bryanrafaelbueno/reconpp
reconpp -u https://your-site.com -f md -o report.md

Recommendation

• SameSite=Lax by default; Strict for banking-type apps
• Keep anti-CSRF tokens anyway (defense in depth)
• Never None unless there's a verified cross-site need

The 70+ point checklist (sessions, headers, API, auth, CI/CD) is in the pt-BR ebook — free sample at the store:

• Store (Pix): https://bryanrafaelbueno.github.io/audit-br-store/
• Free sample: https://bryanrafaelbueno.github.io/audit-br-store/sample.pdf