Add detection of SameSite disabled

[righettod]

Hello,

This PR propose a script to detect when a cookie disable the SameSite protection by setting the value to None.

The objective of the script is to raise a information notice to allow to investigate to see if an CSRF attack can be used due to this settings.

Thanks you very much in advance for your feedback 😃

[PortSwiggerWiener]

Thanks for your PR. Really minor comments:

1. Can you indent the metadata elements with 4 spaces so it's consistent throughout
2. Within the detail and remediation you could use a standard "string" instead of the interpolated string.

Otherwise looks good. 👍

[righettod]

Hi @PortSwiggerWiener,

Thanks a lot for your feedback, I applied all your feedback.

Feel free to reach if I missed something 😃

[PortSwiggerWiener]

Thanks for the changes! 👍

[righettod]

You are welcome, thanks for the review.

[Michelle-PortSwigger]

All looks good to me too

[righettod]

Thank you very much 😃

[michael-eaton-portswigger]

@righettod As a contributor to our GitHub repository, we would like to invite you to our closed Discord community.

It is a place where passionate Burp users, including people who directly work on building and developing Burp here at PortSwigger, can talk about the tooling and web security in general.

If you would like to join, please email us at [email protected] and we will send over an invite link.

Thank you!