Web Security · Junior · Question 32 of 75
What does SameSite=Lax on a session cookie do?
- 1The cookie is sent only over HTTPS
- ✓Correct answer: The cookie isn't sent on cross-site subrequests and POSTs, only on top-level navigations like clicking a link
- 3The cookie can't be read by JavaScript
Explanation
With Lax, a form POST from another site arrives without the cookie, which blocks classic CSRF. Modern browsers use Lax by default when the attribute is missing.