Understanding the SameSite Cookie Attribute
The SameSite attribute is a security mechanism defined in the HTTP-Cookie specification that allows web developers to control whether a cookie is sent with cross-site requests. This attribute is a primary defense against CSRF (Cross-Site Request Forgery) attacks by restricting the contexts in which a browser will include the cookie in its HTTP-Headers.
Policy Values
The SameSite attribute can take one of three values:
- Strict: The browser will only send the cookie for requests originating from the same site where the cookie was initially set. If a user clicks a link from an external domain to the target site, the cookie will not be sent.
- Lax: This is the modern default behavior in Google-Chrome and Mozilla-Firefox. The cookie is withheld on cross-site subrequests (such as images or frames) but is sent when a user navigates to the origin site via a top-level navigation (like clicking a link).
- None: The cookie is sent in all contexts, including cross-site requests. For this value to be valid, the cookie must also include the Secure-Attribute, meaning it can only be transmitted over HTTPS connections.
As documented by the IETF RFC 6265bis and MDN Web Docs, the shift toward a default Lax policy has significantly improved Web-Security by reducing the surface area for session-based attacks.