Intermediate LevelWeb Security & Cyber Defense
Why did modern browsers change the default cookie SameSite attribute to Lax?
❓ Interview Prompt: Explain cookie `SameSite` attribute (`Strict`, `Lax`, `None`), modern browser defaults (`SameSite=Lax`), top-level GET navigation, and CSRF reduction.
Modern browsers (Chrome 80+, Firefox, Safari) updated default cookie security to 'SameSite=Lax' if no 'SameSite' attribute is explicitly set:
SameSite Attribute Behaviors:
•
'SameSite=Strict': Cookie is NEVER sent on cross-site requests.
•
'SameSite=Lax' (Default): Cookie is blocked on cross-site sub-requests (images, 'POST' forms, 'fetch()'), but IS sent on top-level 'GET' navigation (e.g. clicking a link to site).
•
'SameSite=None; Secure': Cookie is sent on all cross-site requests (requires 'Secure' flag!).
Code Implementation Example
http
Set-Cookie: session_id=xyz123; Path=/; Secure; HttpOnly; SameSite=Lax💡Set-Cookie header applying SameSite=Lax default security attribute.
🎯 Interview Key Takeaway
Default SameSite=Lax cookies automatically protect web applications against cross-site POST form CSRF attacks.
#SameSite#Cookies#CSRF Defense#Intermediate
Back to all Web Security & Cyber Defense Questions→