Cookies have appropriate SameSite attribute

Without SameSite, browsers send cookies with every cross-origin request — including requests triggered by a third-party page that loads your API. This is the attack surface that CSRF exploits: an attacker's page silently fires a state-changing request (password change, fund transfer, account deletion) and the browser helpfully attaches the user's session cookie. SameSite=Lax blocks cookies on cross-origin subrequests while preserving top-level navigations; Strict blocks all cross-site cookie sending. OWASP A01 (Broken Access Control) and CWE-352 both identify missing SameSite as a direct enabler of CSRF attacks.

Set SameSite explicitly on every cookie your application writes. Relying on the browser's implicit default (Lax in modern browsers) is fragile — older browsers default to None, and future browser policy changes can silently alter behavior.

// Any cookie-setting location
{ sameSite: 'lax', secure: true, httpOnly: true }

Use Strict for session tokens on apps with no legitimate cross-site navigation need. Use None only when your auth flow requires it (e.g., third-party iframe embeds), and always pair with Secure — SameSite=None without Secure is rejected by modern browsers.