---
id: "GHSA-gmj8-hvj3-49mw"
page: "https://infrastack.ai/live/GHSA-gmj8-hvj3-49mw"
kind: "vulnerability"
aliases: ["GHSA-gmj8-hvj3-49mw"]
title: "Missing SameSite attribute on session cookies from Action Pack session stores"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "actionpack", "fixed": ["8.1.4.1"], "affected": ">= 8.1, < 8.1.4.1", "ecosystem": "rubygems"}, {"name": "actionpack", "fixed": ["8.0.5.2"], "affected": "< 8.0.5.2", "ecosystem": "rubygems"}]
ecosystems: ["rubygems"]
tags: ["actionpack", "api-only", "cwe-352", "package", "rails", "ruby", "self-hosted"]
not_affected_if: ["cookie-store", "same-site-option-set"]
published_at: "2026-11-04T03:02:05+00:00"
first_seen_at: "2026-11-09T22:53:29+00:00"
updated_at: "2026-11-09T22:57:25+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/rails/rails/security/advisories/GHSA-gmj8-hvj3-49mw", "first_seen_at": "2026-11-09T22:53:29+00:00"}]
exploit_sources: []
---

# Missing SameSite attribute on session cookies from Action Pack session stores

Link for people: https://infrastack.ai/live/GHSA-gmj8-hvj3-49mw (this .md is for agents)

Action Pack session stores other than CookieStore write the session cookie without a SameSite attribute, ignoring the configured cookies_same_site_protection default of :lax. In browsers that do not default such cookies to Lax, a cross-site request could carry the session cookie and enable cross-site request forgery against actions that skip authenticity token checks.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:actionpack affected >= 8.1, < 8.1.4.1 fixed 8.1.4.1
- rubygems:actionpack affected < 8.0.5.2 fixed 8.0.5.2

## How to check

- Check the Rails version with `bundle exec rails -v` or in Gemfile.lock for actionpack below `8.1.4.1` or below `8.0.5.2`
- Look in config/initializers or config/application.rb for `config.session_store` and confirm whether it uses `:cache_store`, `:mem_cache_store` or a third-party store without a `same_site:` option
- Check whether API-only actions skip authenticity token verification

## Fix

- actionpack 8.1.x: move to `8.1.4.1`
- actionpack 8.0.x: move to `8.0.5.2`
- Workaround if upgrade is not possible: pass `same_site:` to `config.session_store`, for example `config.session_store :cache_store, same_site: :lax`

## Timeline

- 2026-11-09T22:53:29+00:00 ghsa-repo https://github.com/rails/rails/security/advisories/GHSA-gmj8-hvj3-49mw

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/rails/rails/security/advisories/GHSA-gmj8-hvj3-49mw

## From the sources

### Impact
Action Pack session stores other than `ActionDispatch::Session::CookieStore` (`CacheStore`, `MemCacheStore`, and third-party stores built on `AbstractStore`, `AbstractSecureStore` or the session mixins) write the session cookie without a `SameSite` attribute, regardless of `config.action_dispatch.cookies_same_site_protection`, which defaults to `:lax`. Only `CookieStore` applies the configured policy. In browsers that do not treat a cookie without the attribute as `SameSite=Lax`, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verify an authenticity token, such as those of API-only applications.

Applications are affected when they use a session store other than `CookieStore` and do not pass `same_site:` to `config.session_store`.

### Details
In the fixed releases, every session store sets the session cookie's `SameSite` attribute from `cookies_same_site_protection` when its options have no `:same_site` key. An explicit `same_site:` option, including `same_site: nil`, and a `:same_site` value in a store's `DEFAULT_OPTIONS` still take precedence.

### Workarounds
Pass `same_site:` when configuring the session store, for example `config.session_store :cache_store, same_site: :lax`.

### Releases
The fixed releases are available at the normal locations.

Patches for those who cannot upgrade at once:
- 8.1: https://github.com/rails/rails/commit/2d9f502df941e31ce9bad0e846564f49396bed46.patch
- 8.0: https://github.com/rails/rails/commit/f2392996be723708271a8d30bfcf0edc221e53ef.patch

### Credit
This issue was responsibly reported by HackerOne researcher [tjvc](https://hackerone.com/tjvc).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_