Issue Cookie with Insecure or Improper or Missing SameSite attribute
Risk Prevent cookie information leakage by restricting cookies to first-party or same-site context, Attacks can extend to Cross-Site- Request-Forgery (CSRF) attacks if there are no additional protections in place (such as Anti-CSRF tokens).
Cause Sensitive Cookie with Improper or Insecure or Missing SameSite Attribute
Fix Review possible solutions for configuring SameSite Cookie attribute to recommended values
for K8s, you may edit the ingress configuration, set samesite value
nginx.ingress.kubernetes.io/session-cookie-samesite: "Strict" ……
阅读全文