JavaScript · Senior · Question 67 of 75
How does SameSite=Lax on a session cookie help against CSRF?
- ✓Correct answer: The cookie isn't sent on cross-site subrequests and POSTs, only on top-level GET navigations
- 2It encrypts the cookie
- 3It makes the cookie readable only by JavaScript
Explanation
Browsers default to Lax when unspecified. Strict also blocks cross-site navigations; None requires Secure. CSRF tokens are still advised for sensitive actions.