Share some knowledge, skills and others — security research, pentesting notes and more.

View on GitHub
17 November 2020

Cookie SameSite Attribute

by allencharp

What are first-party and third-party cookies?

SameSite attribute

The SameSite attribute (part of RFC 6265bis) controls when cookies are sent on cross-site requests. It takes three values:

Strict

If you set SameSite to Strict, your cookie will only be sent in a first-party context. In user terms, the cookie will only be sent if the site for the cookie matches the site currently shown in the browser’s URL bar. Even top-level navigation from an external link will not include the cookie — which can hurt UX (a link from an email won’t keep the user logged in).

Lax

When you set a cookie’s SameSite attribute to Lax, the cookie will be sent along with GET requests initiated by third-party websites. The important point is that the GET request must cause a top-level navigation (e.g. clicking a link) for the cookie to be sent. Subresource requests and fetch/XHR calls are still blocked.

Lax is a good default: it preserves the “logged in via link” experience while blocking most cross-site request forgery.

None

Cookies with SameSite=None are sent in all contexts, including cross-site requests, but the cookie must also be marked Secure so it is only sent over HTTPS. Browsers reject SameSite=None without Secure.

SameSite and CSRF

Cross-Site Request Forgery (CSRF) works because browsers automatically attach cookies to requests made from any site. Setting SameSite=Lax (or Strict) on session cookies makes the browser withhold those cookies on cross-site POST requests and XHR/fetch, which breaks the most common CSRF delivery paths.

Important nuance: SameSite is a solid mitigation but not a complete CSRF defense — a strict allowlist of origins plus CSRF tokens is still recommended for sensitive actions. Also note the Lax exception for top-level GET navigations can still be abused in some scenarios.

Browser defaults

Modern browsers (Chrome 80+, Edge, Firefox 115+) have moved toward treating cookies without a SameSite attribute as Lax by default. This means the absence of the attribute is no longer “send everywhere” — a meaningful security improvement, but it also means developers should set the attribute explicitly rather than relying on defaults.

Summary

SameSite is a cheap and effective CSRF mitigation: pick Lax as the default for session cookies, use Strict for highly sensitive cookies, and only use None (with Secure) when cross-site cookie delivery is genuinely required.

tags: web-security - cookies - samesite