CookiesSameSite cookies and CSRF: what None, Lax and Strict really do SameSite is one word on your cookie that decides whether the browser sends it on requests coming from other sites. Get it wrong and you open the door to CSRF. Sep 24, 2026 · 3 min read