Bypassing Same Site cookie restrictions

Summary: PortSwigger's research explains that SameSite is a browser mechanism limiting when cookies are sent on cross-site requests, and that since 2021 Chrome applies Lax restrictions by default when a site does not set its own level. It describes bypasses including eliciting GET requests against Lax cookies, method-override parameters such as Symfony's _method, and client-side redirect gadgets that turn an attacker-controlled request into a same-site request carrying Strict cookies.
What you should know: A cross-origin request can still be same-site, so an XSS or open redirect on any sibling domain can defeat site-based cookie defenses across the whole site. Lax-by-default also pushed some sites to set SameSite=None on all cookies, including sensitive ones.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026