SameSite
SameSite is a security attribute of browser cookies that controls whether a cookie is sent with cross-site requests, thereby defending against CSRF attacks. Its possible values are Strict, Lax, and None.
Timeline (last 90 days)
SameSite=Lax allows cookies to be carried on GET requests for top-level navigation, and is the current default in most browsers.
The SameSite attribute cannot defend against compromised subdomains or requests initiated by same-site XSS, and also depends on correct browser implementation, so it cannot replace the double-submit cookie or synchronizer token pattern.
The SameSite attribute is a cookie control field used by browsers to defend against CSRF, with three main values: Strict, Lax, and None.
Lax is the current browser default for SameSite, allowing cookies to be carried on top-level navigation GET requests, but not on cross-site subrequests such as POST.
SameSite=None requires Secure to be set at the same time, allowing cookies to be sent cross-site.
All Facts (5)
SameSite=Lax allows cookies to be carried on GET requests for top-level navigation, and is the current default in most browsers.
50%UnverifiedThe SameSite attribute cannot defend against compromised subdomains or requests initiated by same-site XSS, and also depends on correct browser implementation, so it cannot replace the double-submit cookie or synchronizer token pattern.
50%UnverifiedThe SameSite attribute is a cookie control field used by browsers to defend against CSRF, with three main values: Strict, Lax, and None.
50%UnverifiedLax is the current browser default for SameSite, allowing cookies to be carried on top-level navigation GET requests, but not on cross-site subrequests such as POST.
50%UnverifiedSameSite=None requires Secure to be set at the same time, allowing cookies to be sent cross-site.
50%