Beginner LevelAuthentication & Authorization
How do SameSite Cookie attributes (Strict, Lax, None) defend against CSRF attacks?
❓ Interview Prompt: Explain Cross-Site Request Forgery (CSRF), cookie transmission rules, and SameSite attribute values.
Cross-Site Request Forgery (CSRF) occurs when a malicious website causes a user's web browser to perform an unwanted action on a trusted site where the user is currently authenticated (by exploiting automatic cookie transmission).
SameSite Cookie Attribute Defense:
The 'SameSite' attribute controls whether cookies are sent with cross-site requests:
1
'SameSite=Strict': The cookie is NEVER sent in cross-site requests (even when clicking a link from an external site). Maximum security.
2
'SameSite=Lax' (Modern Browser Default): The cookie is withheld on cross-site sub-requests (e.g. images, AJAX POSTs), but sent when a user follows a top-level link ('<a>' href GET navigation).
3
'SameSite=None': The cookie is sent on all cross-site requests. Must be accompanied by the 'Secure' flag (HTTPS only).
Code Implementation Example
typescript
// Secure SameSite cookie header configuration
res.setHeader('Set-Cookie', [
'session_id=xyz123; Path=/; Secure; HttpOnly; SameSite=Strict',
'remember_me=abc456; Path=/; Secure; HttpOnly; SameSite=Lax'
]);💡Setting Set-Cookie headers with Strict and Lax SameSite flags.
🎯 Interview Key Takeaway
SameSite=Strict/Lax prevents browsers from attaching session cookies to cross-site malicious AJAX POST requests, mitigating CSRF.
#SameSite#Cookies#CSRF#Security#Beginner
Back to all Authentication & Authorization Questions→