Same Site Reporter
Summary: PortSwigger lists a Burp extension called SameSite Reporter, version 1.0 by Louis Dion-Marcil, last updated 12 June 2020, that adds a passive scan check reporting cookies where the SameSite flag is explicitly set to None or is missing. The BApp Store page rates its overall system impact as Low and notes that extensions are written by third-party Burp users, with PortSwigger making no warranty about their quality or usefulness.
What's compelling: A missing or None SameSite flag on an important cookie is the kind of gap testers admit they often forget to check, and this check only surfaces it if someone installs and runs the extension.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026