SameSitesäännön

The SameSite cookie attribute is a security feature introduced to mitigate cross-site request forgery (CSRF) attacks. It provides developers with a mechanism to declare how a cookie should be sent with cross-site requests. The attribute can be set to one of three values: Strict, Lax, or None.

Strict is the most restrictive setting. When a cookie is set to Strict, it will only be sent when the request originates from the same site that set the cookie. This means it won't be sent even for top-level navigations initiated by a link from another site.

Lax is the default behavior in modern browsers for cookies that do not explicitly specify a SameSite attribute. With Lax, cookies are sent with top-level navigations, such as when a user clicks a link to visit another site, but they are not sent with cross-site requests initiated by scripts or embedded resources like images and iframes.

None requires explicit opt-in and is used when cookies are intended to be sent with all requests, including cross-site requests. However, for security reasons, cookies marked with None must also have the Secure attribute set, meaning they will only be sent over HTTPS connections. This ensures that sensitive cookies are protected from being transmitted over unencrypted channels.

The SameSite attribute helps protect users from various types of attacks where malicious websites could trick a user's browser into making requests to a trusted site, potentially performing actions on behalf of the user without their consent. By controlling when cookies are sent, the SameSite attribute significantly enhances the security of web applications.