A SameSite cookie controls whether the browser includes a cookie when another site sends a request to your application. This limits cross-site request forgery (CSRF): an attacker may otherwise trick a logged-in user into submitting an unwanted action, such as posting content or deleting an account. section 2.14
Choose the policy according to the balance between protection and sign-in convenience:
- SameSite=Strict strips cookies from cross-site requests, including a user’s click through an external link. It provides stronger isolation but may require the user to log in again. section 2.14 section 6.11
- SameSite=Lax permits cookies on cross-site GET requests but strips them from POST, PUT, and DELETE requests. This preserves ordinary link navigation while protecting state-changing requests. section 2.14
- Add SameSite to sensitive cookies, including session and anti-CSRF cookies. Treat it as an additional defense rather than a replacement for anti-CSRF tokens. section 6.11
Cookie configuration
A practical session-cookie header is: Set-Cookie: session_id=2308797c-348a-4939-9049; SameSite=Lax. For a stricter policy, use SameSite=Strict alongside Secure and HttpOnly.
Modern browsers use Lax when SameSite is omitted, but explicitly adding the attribute supports users of older browsers. Also design GET requests without side effects and keep anti-CSRF protections for stronger coverage. section 2.14 section 6.18
