SameSite is a browser cookie attribute that controls whether a cookie is included in cross-site requests. In practice, it helps a browser decide if a session cookie should be sent when the request originates from a different site, such as a link, form submission, or embedded resource. Common values are Strict, Lax, and None.
This matters because many attacks rely on a victim’s browser sending authenticated cookies without the user’s intent. By restricting cross-site cookie transmission, SameSite can reduce CSRF risk and limit abuse of cross-site request flows. It is also a useful defense-in-depth control when other bugs expose request boundaries or leak responses, because fewer cookies are automatically attached to suspicious requests. However, SameSite is not a full theft prevention control: it does not stop cookies from being stolen through same-site compromise, server-side leakage, or client-side scripts that can already read them. Modern browsers also require SameSite=None cookies to use Secure, which helps keep cross-site cookies confined to HTTPS.