System Design · Middle · Question 54 of 75

What do `SameSite=Lax` and `SameSite=Strict` cookies change?

✓Correct answer: They restrict sending cookies on cross-site requests: Strict never, Lax only on top-level navigations with safe methods
2They encrypt cookies
3They make cookies readable only by JavaScript

Explanation

Lax (the default in modern browsers) blocks most CSRF while keeping links from other sites logged in. None requires Secure.

Further reading

Test yourself

Take the System Design · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.