{
    "content": "<h1>Understanding the <a href=\"..\/SameSite\/\">SameSite<\/a> Cookie Attribute<\/h1><p>The <a href=\"..\/SameSite\/\">SameSite<\/a> attribute is a security mechanism defined in the <a href=\"..\/HTTP-Cookie\/\">HTTP-Cookie<\/a> specification that allows web developers to control whether a cookie is sent with cross-site requests. This attribute is a primary defense against <a href=\"..\/CSRF\/\">CSRF<\/a> (Cross-Site Request Forgery) attacks by restricting the contexts in which a browser will include the cookie in its <a href=\"..\/HTTP-Headers\/\">HTTP-Headers<\/a>.<\/p><h2>Policy Values<\/h2><p>The <a href=\"..\/SameSite\/\">SameSite<\/a> attribute can take one of three values:<\/p><ul><li><strong><a href=\"..\/Strict\/\">Strict<\/a>:<\/strong> The browser will only send the cookie for requests originating from the same site where the cookie was initially set. If a user clicks a link from an external domain to the target site, the cookie will not be sent.<\/li><li><strong><a href=\"..\/Lax\/\">Lax<\/a>:<\/strong> This is the modern default behavior in <a href=\"..\/Google-Chrome\/\">Google-Chrome<\/a> and <a href=\"..\/Mozilla-Firefox\/\">Mozilla-Firefox<\/a>. The cookie is withheld on cross-site subrequests (such as images or frames) but is sent when a user navigates to the origin site via a top-level navigation (like clicking a link).<\/li><li><strong><a href=\"..\/None\/\">None<\/a>:<\/strong> The cookie is sent in all contexts, including cross-site requests. For this value to be valid, the cookie must also include the <a href=\"..\/Secure-Attribute\/\">Secure-Attribute<\/a>, meaning it can only be transmitted over <a href=\"..\/HTTPS\/\">HTTPS<\/a> connections.<\/li><\/ul><p>As documented by the <a href=\"https:\/\/datatracker.ietf.org\/doc\/html\/draft-ietf-httpbis-rfc6265bis-03#section-4.1.2.7\">IETF RFC 6265bis<\/a> and <a href=\"https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Headers\/Set-Cookie\/SameSite\">MDN Web Docs<\/a>, the shift toward a default <a href=\"..\/Lax\/\">Lax<\/a> policy has significantly improved <a href=\"..\/Web-Security\/\">Web-Security<\/a> by reducing the surface area for session-based attacks.<\/p><h3>Related Topics<\/h3><ul><li><a href=\"..\/CSRF\/\">CSRF<\/a><\/li><li><a href=\"..\/Cross-Origin-Resource-Sharing\/\">Cross-Origin-Resource-Sharing<\/a><\/li><li><a href=\"..\/Secure-Attribute\/\">Secure-Attribute<\/a><\/li><li><a href=\"..\/Session-Management\/\">Session-Management<\/a><\/li><\/ul>",
    "tags": [
        "samesite",
        "cookies",
        "security",
        "csrf",
        "http",
        "web-security",
        "authentication",
        "browser",
        "headers",
        "privacy"
    ]
}