What does SameSite do in cookies?

Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.

Key takeaways

• SameSite restricts when a browser sends a cookie, protecting against CSRF and cross - site tracking.
• Strict blocks all cross - site requests, Lax allows safe top - level navigations, and None sends everywhere but requires Secure.
• Modern browsers default to Lax when the attribute is omitted, but explicit settings avoid inconsistencies.

What is the SameSite attribute and why does it matter?

SameSite is a cookie attribute that tells the browser when the cookie may be included in an outgoing request. By limiting cookie transmission to same - site contexts, it mitigates CSRF and reduces unwanted cross - site data leakage.

How does SameSite change cookie transmission?

When SameSite is set, the browser evaluates the request origin before attaching the cookie. Without the attribute, a cookie is sent with every request to its domain. With SameSite, only requests that satisfy the chosen policy will carry the cookie, preventing browsers from automatically attaching authentication cookies to forged cross - site requests.

What are the possible SameSite values?

• Strict - The cookie is sent only for requests that originate from the same registrable domain. No cross - site navigations, sub - resource loads, or form posts include the cookie.
• Lax - The cookie is sent for same - site requests and for top - level cross - site navigations that use a safe HTTP method (GET, HEAD). It is not sent on cross - site sub - resource requests, POST, PUT, DELETE, or XHR/fetch calls.
• None - The cookie is sent with all same - site and cross - site requests. When None is used, the cookie must also have the Secure attribute, otherwise browsers will reject it.

What is the default SameSite behavior?

If SameSite is omitted, modern browsers treat the cookie as Lax (or a slightly more permissive variant that still blocks most CSRF - prone requests). Relying on the implicit default can lead to inconsistent behavior across browsers, so explicitly setting the attribute is recommended.

How does SameSite affect cookie creation?

Cookies with SameSite=Strict or SameSite=Lax cannot be set via responses to cross - site sub - resource requests; they can only be set on top - level navigations (same - site or cross - site). This prevents an attacker from planting a cookie through a hidden image or script request.

Why is SameSite important for security?

By preventing the browser from automatically attaching authentication cookies to forged cross - site requests, SameSite provides a strong layer of CSRF protection. It also reduces the risk of unintended tracking across sites because the cookie is not sent on most cross - origin requests.

Compatibility considerations

All major browsers support SameSite, but the default value differs. Chrome, Edge, and Opera have adopted Lax as the default, while older versions of Firefox and Safari may treat the attribute as missing. Explicitly setting SameSite=Strict, Lax, or None; Secure ensures consistent behavior across browsers.

How to implement SameSite correctly

Set-Cookie: sessionId=abc123; Path=/; HttpOnly; Secure; SameSite=Strict

1. Choose the strictest policy that still allows your legitimate workflows.
2. If you need cross - site usage (e.g., third - party embeds), use SameSite=None; Secure.
3. Test all authentication flows after changing the attribute to catch any broken functionality.
4. Deploy the change gradually, monitoring logs for rejected cookies (browsers will drop non - compliant cookies).

How SameSite interacts with other cookie flags

• Secure - Required when using SameSite=None and ensures the cookie is only sent over HTTPS.
• HttpOnly - Prevents JavaScript access but does not affect SameSite behavior.
• SameSite - Works alongside Secure and HttpOnly to form a defense - in - depth strategy for cookies.

When to audit SameSite settings

Run a regular scan of your public endpoints to verify that every Set - Cookie header includes an explicit SameSite value. Decloak’s free scan performs other checks such as HTTP/TLS posture, static HTML analysis, and third - party domain mapping, helping you identify related misconfigurations.

Quick checklist

• All Set - Cookie headers include SameSite=.
• SameSite=None cookies also have Secure.
• Test authentication flows after any change.
• Monitor browser console warnings for rejected cookies.

Summary

SameSite tells browsers when to include a cookie in outgoing HTTP requests. Strict blocks all cross - site usage, Lax allows only safe top - level navigations, and None disables the restriction but requires Secure. Setting it explicitly eliminates browser defaults, provides CSRF protection, and improves overall cookie security.