Web Security · Junior · Question 33 of 75

How is `SameSite=Strict` different from `Lax`?

1Strict sends the cookie to all sites, Lax only to subdomains
2Strict makes the cookie expire when the tab closes
✓Correct answer: Strict doesn't send the cookie even when the user follows a link from another site

Explanation

With Strict, a user arriving from an email link looks logged out on the first page. That's why Lax is a common default for session cookies.

Further reading

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.