Cookie has weak or missing SameSite protection

What does this mean?

At least one cookie your site sets either has no SameSite attribute or is set to SameSite=None, meaning browsers will still attach it to requests that originate from a completely different website. That's the core mechanism behind cross-site request forgery (CSRF): a malicious page elsewhere on the internet can trigger a request to your site that automatically carries the visitor's real session cookie along with it.

What are the potential impacts?

• A malicious website can trigger state-changing requests to your site (changing account settings, making a purchase, transferring funds) that ride along on a visitor's existing, legitimate session — this is exactly what cross-site request forgery means.
• The visitor doesn't need to do anything more than load a malicious page while already logged into your site — no phishing click or credential theft required for this particular attack.
• Modern browsers have started defaulting cookies to SameSite=Lax automatically, which reduces but doesn't eliminate this risk — an explicit, correct setting is still the reliable fix.