SameSite Cookie Attribute

The SameSite cookie attribute is a browser security mechanism that controls when cookies are included in cross-site requests. Introduced to combat CSRF attacks, it provides three modes: Strict, which never sends the cookie with any cross-site request; Lax, which sends the cookie only with top-level navigations using safe HTTP methods (GET); and None, which sends the cookie with all cross-site requests but requires the Secure flag. Most modern browsers default to Lax when no SameSite attribute is specified.

SameSite=Strict provides the strongest protection but can impact user experience -- for example, a user clicking a link to your site from an email or external page won't have their session cookie sent, requiring them to log in again. SameSite=Lax is generally the recommended default because it allows cookies on top-level GET navigations (so links from external sites work) while blocking cookies on cross-site POST requests, form submissions from other origins, and resource loads embedded in other sites.

SameSite=None is necessary for legitimate cross-site use cases such as third-party embeds, widgets, single sign-on flows, and cross-site API calls that require authentication. When using None, the Secure flag is mandatory (browsers reject SameSite=None without Secure). Organizations should audit their cookies to identify which truly need None and apply Strict or Lax to all others. Note that SameSite alone is not a complete CSRF defense -- it should be combined with CSRF tokens for defense in depth.