SameSite Lax

Meaning

SameSite=Lax is a value that withholds the cookie from most cross-site subrequests, such as images, frames and form posts, but allows it on top-level navigations that use a safe method such as GET. A visitor following a link from another site therefore arrives logged in, while a hidden form on a malicious page does not carry the cookie. MDN notes that a more permissive Lax, which also sends cookies on POST within two minutes of being set, is used when Lax is the default. Lax suits most session cookies. See also: SameSite Strict, SameSite None, CSRF, the guide "SameSite Strict, Lax and None Explained".