Checks

Session cookie missing SameSite

A session-like cookie does not set SameSite.

Why it matters

SameSite limits when the browser attaches the cookie to a request that started on another site, which is the usual CSRF path.

What to do

Set SameSite=Lax or Strict.

Reference

Cookie attributes such as Secure, HttpOnly, and SameSite protect session tokens in browsers.

OWASP Session Management Cheat Sheet