Web Security · Middle · Question 23 of 75

Does `SameSite=Lax` fully replace CSRF tokens?

✓Correct answer: Not always: it doesn't help against state-changing GETs or attacks from a sibling subdomain, which is same-site
2Yes, CSRF is impossible with any SameSite value
3No, SameSite has no effect on CSRF

Explanation

SameSite is defense in depth. Sensitive actions still benefit from tokens or origin checks, especially when subdomains aren't all trusted.

Further reading

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.