SameSite

Meaning

SameSite is a cookie attribute that controls whether the cookie is sent on requests that start from another site. It has three values: Strict, Lax and None. A site here means the registrable domain, so www.example.com and api.example.com are the same site even though they are different origins. Some browsers treat a cookie with no SameSite attribute as Lax, but MDN says the default is not universal, so set the value explicitly on every cookie. SameSite sharply reduces CSRF risk but is not a full replacement for anti-forgery tokens. See also: CSRF, Third-party cookie, the guide "SameSite Strict, Lax and None Explained".