SameSite

How it works

The browser compares the site of the request URL with the site of the top page. A site is the scheme plus the registrable domain, for example https://example.com. If the two sites are different, the request is cross-site, and SameSite decides if the cookie goes with it.

A frame from https://widget.example on https://shop.example is cross-site. Its requests to widget.example carry only the cookies with SameSite=None. This also helps against clickjacking, because a page in a frame on another site often shows the visitor as signed out.

Values

Value	When the browser sends the cookie
Strict	Only with requests from the same site
Lax	Same-site requests, and top-level navigations with a safe method like GET
None	All requests, same-site and cross-site. Needs Secure
Not set	Some browsers, such as Chrome, use Lax

When a browser uses Lax as the default, it is less strict. It also sends the cookie with a cross-site POST if the cookie is less than two minutes old.

Set-Cookie: session=abc123; Path=/; Secure; HttpOnly; SameSite=None

# Only your own site
Set-Cookie: session=abc123; Path=/; Secure; HttpOnly; SameSite=Lax

# Also in a cross-site iframe
Set-Cookie: session=abc123; Path=/; Secure; HttpOnly; SameSite=None