SameSite Cookie Attribute

Controls whether browsers send a cookie with cross-site requests.

Use `SameSite=Lax` as a practical default for many session cookies; use `Strict` or `None` based on the actual cross-site flow.

cookiessecuritycsrfprivacy

Typical session cookie (http)

Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Lax; Path=/

Strict provides the strongest cross-site restriction but can make login links and external navigation feel surprising. Lax allows cookies on top-level safe navigations while blocking many cross-site request contexts.

SameSite=None permits cross-site sending and must be paired with Secure. Choose it only when a real cross-site embed or integration needs it.

Common mistakes

Using SameSite=None without Secure.
Relying on SameSite alone instead of adding CSRF protection for state-changing requests.

Secure Cookie Attribute HttpOnly Cookie Attribute Referrer-Policy

Sources

MDN Web Docs: HTTP