SameSite Cookie
The SameSite cookie attribute (Strict/Lax/None) controls whether the browser sends cookies in cross-site requests, defending against CSRF.
Purpose
To defend against CSRF and information leakage through browser-level cross-site cookie restrictions; a modern Web security baseline.
Mechanism
Strict: never sent cross-site; Lax: sent on top-level GET navigation (default); None: always sent (requires Secure). Strict is safest but affects SSO UX; Lax balances security and usability.
Use cases
- CSRF defense
- Cookie security
- Cross-site restriction