Browser & Web Performance · Junior · Question 67 of 75

What does `SameSite=Lax` mean for a cookie?

1It's sent on every request, including cross-site fetch
✓Correct answer: It isn't sent on most cross-site requests, but is sent on top-level navigations like clicking a link
3It's never sent to the server

Explanation

Lax protects against many CSRF attacks while keeping links from other sites working. Chrome treats cookies without SameSite as Lax.

Further reading

Test yourself

Take the Browser & Web Performance · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.