Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Query Regarding Cross-site request forgery

Srini | Last updated: Sep 01, 2020 07:16AM UTC

Issue : In Our application we are using cookie lastAccesTimeForCurrentSession to validate the session. Previously we were not using the SameSite attribute in Cookie, Now we started using SameSite with Strict mode. Browser we used for Burp Scanner is Google Chrome 85.0.x, For which Default SameSite setting is LAX, which as per documentation won't allow Post request to Send Cookies from Third-party sites However Burp Scanner able to send the our Site cookies, which result in reporting Cross-site request forgery in the report. We would like to understand How burp scanner able to send those Cookies Post Request, Is Cross-site request forgery still exist in our site ? Or Can we assume that test as false indication ? Attached Burp scanner Report, Google chrome snapshots for the reference.

Uthman, PortSwigger Agent | Last updated: Sep 01, 2020 09:58AM UTC