Glossary · Security

SameSite Cookie Attribute

SameSite controls whether a browser sends a cookie on cross-site requests, with Strict, Lax and None values, helping reduce CSRF and tracking.

Updated October 6, 2026

SameSite is a cookie attribute that tells the browser whether to attach the cookie to requests that originate from a different site. It takes three values: Strict, Lax and None.

Why it matters

Cross-site request forgery depends on the browser automatically sending cookies with a request triggered by another site. SameSite restricts that behaviour. Strict sends the cookie only for same-site requests. Lax also sends it on top-level navigations that use safe methods such as GET, like clicking a link. None allows cross-site sending but must be combined with Secure. Many browsers treat cookies without the attribute as Lax.

Example

Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Lax

A form posted from another website will not carry this cookie, so a forged state-changing request arrives without a session.

Common mistakes

  • Treating SameSite as a complete CSRF defence. Token checks are still recommended.
  • Using None for convenience when the cookie is not needed in a cross-site context.
  • Forgetting that "site" means the registrable domain, so subdomains count as same-site.
  • Setting None without Secure, which browsers reject.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · SecurityCookie Prefixes (__Host- and __Secure-)Cookie prefixes are name prefixes that make browsers enforce extra rules, such as Secure and no Domain attribute, on that cookie.Glossary · SecurityHttpOnly CookieThe HttpOnly flag marks a cookie so that browser JavaScript cannot read it, which limits theft of session cookies through cross-site scripting.Glossary · SecuritySecure Cookie FlagThe Secure attribute tells browsers to send a cookie only over HTTPS, so it is not exposed in plain text on unencrypted connections.Guide · SSL & SecurityCookie Flags Explained: Secure, HttpOnly and SameSiteWhat the Secure, HttpOnly, SameSite, Domain, Path and cookie prefix attributes do, how to set them in common stacks, and how to debug cookies that go missing.7 min readGuide · E-commerceWooCommerce Checkout Errors: Troubleshooting Guide for Store OwnersDiagnose WooCommerce checkout failures step by step: caching, AJAX and REST errors, plugin conflicts, sessions, payment gateways, SSL and server limits.8 min readError fix · Browser errorsERR_CACHE_MISS: "Confirm Form Resubmission" in Chrome ExplainedERR_CACHE_MISS appears when Chrome needs data it no longer has cached, often after a form POST. Learn the visitor fixes and the developer cause.4 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.