SameSite Strict

Meaning

SameSite=Strict is a value under which the cookie is sent only on requests that start from the same site, even excluding navigations from links on other sites. That makes it very protective against forgery, but a user who clicks a link in an email may arrive looking logged out until they navigate again. It suits cookies guarding high-risk actions, such as an administrative area, where one extra click is acceptable. For ordinary session cookies Lax is often the better balance. See also: SameSite Lax, SameSite None, CSRF, the guide "SameSite Strict, Lax and None Explained".