Description
The marker cookie set in worker_v2/requesthandlers/markdevice.go (line 14) is missing the SameSite attribute, which could make it vulnerable to CSRF attacks.
Current Implementation
The cookie is currently set with HttpOnly and Secure flags:
c.SetCookie("marker", new_marker, 3600*24*365*2, "/v2/events", env.OWN_DOMAIN, true, true)Recommendation
Add SameSite=Strict or SameSite=Lax to the cookie configuration. Since Gin's standard SetCookie method doesn't expose SameSite directly, consider using the http.Cookie struct with net/http or a custom wrapper to set the attribute explicitly.
References
Description
The
markercookie set inworker_v2/requesthandlers/markdevice.go(line 14) is missing theSameSiteattribute, which could make it vulnerable to CSRF attacks.Current Implementation
The cookie is currently set with
HttpOnlyandSecureflags:Recommendation
Add
SameSite=StrictorSameSite=Laxto the cookie configuration. Since Gin's standardSetCookiemethod doesn't expose SameSite directly, consider using thehttp.Cookiestruct withnet/httpor a custom wrapper to set the attribute explicitly.References