CodeParkSameSite decides if the browser sends a cookie on requests that come from another site:
- Strict: never on cross-site requests.
- Lax: on same-site requests and on top-level navigations with safe methods like GET.
- None: on all requests, and it must also have
Secure.
With no attribute, Chromium-based browsers (Chrome, Edge) treat the cookie as Lax. Not every browser does this, so always set the attribute yourself.
What "same-site" means. Two URLs are same-site when they have the same scheme (like https) and the same registrable domain. The registrable domain is the part you buy, like shop.com. So app.shop.com and api.shop.com are same-site. shop.com and evil.com are not.
Strict in detail. The cookie is not sent even when a user clicks a link on another site that leads to yours. So the user arrives looking logged out.
Lax in detail. The cookie is not sent on cross-site POSTs, iframes, images or fetch calls.
None in detail. The cookie is sent on all requests, including cross-site ones. It must be combined with Secure. Many browsers also apply third-party cookie restrictions to None cookies.
- Same-site means the same scheme plus the same registrable domain. It is not the same as same-origin.
- Strict cookies are never sent on cross-site requests.
- Lax cookies are sent cross-site only on top-level navigations with safe methods.
- None cookies are always sent, and they require Secure.
- The default when SameSite is unset varies by browser. Chromium uses Lax, so set it explicitly.