Cookie SameSite is an attribute on Set-Cookie that controls whether the browser will attach the cookie to cross-site requests. It’s the modern replacement for hand-rolled CSRF tokens on many workflows.
Attribute Values
Set-Cookie: session=abc123; SameSite=Lax; Secure; HttpOnly
Set-Cookie: cart=xyz; SameSite=None; Secure| Value | Behaviour |
|---|---|
Strict | Never sent on any cross-site request. Highest security. |
Lax | Sent on top-level GET navigations only. Modern browser default. |
None | Sent on all cross-site requests. Requires Secure. |
Why It Matters
Before SameSite, browsers sent every cookie with every cross-site request. That’s the CSRF vulnerability: attacker’s site triggers a POST to your bank, browser attaches your session cookie, bank thinks the request came from you.
SameSite=Lax (browser default since 2020) blocks the CSRF class of attacks for POST requests without breaking the “click a link and be logged in” UX.
Common Miss
- Third-party cookies that need
SameSite=None— must also haveSecure. WithoutSecure, browsers refuse to set the cookie - Session cookies set to
SameSite=Nonewithout a strong reason — reintroduces CSRF risk - Not marking cookies
HttpOnly— JavaScript can read them, defeating server-only enforcement
Check your cookie posture with the security headers audit.
Related
Check the CORS glossary entry, the CSP glossary entry, and read the HTTP security headers explainer.