Which SameSite value sends the cookie when a user follows a link to your site from another site, but not on cross-site POST requests, images or fetches?

Lax sends cookies on top-level navigations with safe methods like GET, such as following a link to your site. It does not send them on cross-site subrequests (images, fetches) or on POSTs.

Strict is the tempting wrong answer. It would not send the cookie even when the user follows a link from another site. None sends the cookie everywhere, and it requires Secure. Secure is a separate attribute, not a SameSite value.