2026-09-09 · 8 min read
- cookies
- authentication
- browser-security
The SameSite cookie attribute controls whether a browser attaches a cookie in cross-site contexts. It reduces cross-site request forgery exposure, but the result depends on the schemeful site relationship, request method, navigation type, embedding context, browser defaults, and other cookie attributes.
An origin includes scheme, host, and port, while a site is based on scheme and registrable domain. Two subdomains can be cross-origin yet same-site, so both concepts must be considered in authentication and cross-origin resource sharing designs.
Inventory browser flows before choosing attributes
Map sign-in redirects, form callbacks, fetch requests, iframes, payment or identity-provider handoffs, subdomains, development hosts, logout, and session refresh. For each request, record its top-level site, initiator, method, destination, and whether credentials are required.
- Use Secure for all production session cookies.
- Use HttpOnly when scripts do not need the value.
- Prefer host-only cookies with the narrowest practical Path.
- Set explicit expiry and rotation behavior.
Apply SameSite deliberately
Strict offers the narrowest cross-site sending behavior but can interrupt legitimate inbound navigation. Lax supports common top-level safe navigations while withholding cookies in many embedded or programmatic contexts. None permits cross-site contexts and requires Secure.
SameSite=None is not a complete integration fix. Cross-origin fetch also needs explicit origin and credential handling, while embedded experiences may face additional browser privacy restrictions or partitioned-storage rules.
Protect every state-changing request
SameSite is one defense layer, not a replacement for request-forgery controls. Validate OAuth state, use anti-forgery tokens or appropriate origin checks, require non-safe methods for changes, and avoid side effects on GET.
- Rotate the session after successful authentication.
- Separate short-lived login correlation from the application session.
- Do not place bearer credentials in query strings.
- Redact cookie values from logs and diagnostics.
Verify the real deployment boundary
Use Flashman's URL tool to compare scheme, host, port, and paths; timestamp converter for expiry; diff for redacted Set-Cookie attributes; JWT tool only for synthetic token containers; and hash tool for non-reversible fixture labels.
Test top-level GET and POST navigation, fetch with credentials, iframes, subdomains, HTTP-to-HTTPS redirects, reverse-proxy headers, local development, browser privacy modes, expiry, logout, session rotation, and supported desktop and mobile browsers.