SameSiteLaxStrictNone

SameSiteLaxStrictNone is a directive attribute for the HTTP cookie protocol, introduced by Google in 2017 as a security feature to mitigate certain types of cross-site request forgery (CSRF) attacks. It is one of four available values for the SameSite attribute, which affects how cookies are sent with requests.

When a cookie is set with the SameSiteLaxStrictNone directive, it is eligible to be included with same-site requests from any origin. This means that if a user navigates from a trusted website to a third-party site, cookies with this directive will be sent with the request from the third-party site to the trusted site, despite the fact that the cookies are of the domain of the trusted site.

This behavior is the opposite of cookies with the SameSiteLaxStrict or SameSiteStrict values, which will only be sent with cross-site requests from trusted destinations or strictly originate from the trusted domain respectively. Conversely, cookies set with the SameSiteNone value will never be included in cross-site requests, even those from trusted destinations.

Accepting cookies with the SameSiteLaxStrictNone directive allows users to receive third-party cookies that provide features beneficial to their experience, such as login, cart, and locale information, while minimizing risks related to CSRF attacks by preventing cookies from leaking to malicious sites. This is a compromise which balance the protection of data and the functionality of the web.