SameSite attribute explained in simple terms

Cookies help websites remember you. They're like little reminders for the website about your visit. But these cookies need rules to work safely. One key rule is the SameSite attribute. It helps websites be more secure. Now, let's dive into what SameSite really means.

What is SameSite?

SameSite is a tag added to cookies. It tells the browser how to handle your cookies based on where you're surfing from. It has three settings: `Strict`, `Lax`, and `None`. Each setting changes how cookies travel between websites.

Below is an explanation of the three SameSite Settings:

1. Strict: This is the strictest setting. The cookie will only work if you're on the website that created it. If you click a link from another site, the cookie won't come along. This is great for keeping your data safe but might make some website functions less smooth.

Let me clarify how the strict setting works:

When you're using a cookie with the Strict setting from site1.com, and you move to site2.com, your site1.com cookie won't be visible or accessible on site2.com. The Strict setting makes sure your cookie is only used where it was originally set, which in this example is at site1.com.

This restriction helps in keeping your browsing secure as it prevents other sites (like site2.com) from seeing or interacting with your site1.com cookies. In simple terms, your site1.com cookie stays put on site1.com, regardless of where else you go browsing.

2. Lax: A bit more flexible than Strict. Here, cookies are sent with top-level navigation. That means if you click a link to a site, its cookies come too, but not during background fetching. This setting balances security and user experience.

With the Lax setting, here's how it works:

Suppose you have a cookie from site1.com with the Lax setting. If you directly visit site1.com, the cookie works just fine, doing its job, like keeping you logged in. Now, let's say you find a link to site1.com on site2.com and click on it. In this case, because of the Lax setting, your site1.com cookie will still come into play when you land on site1.com through the link from site2.com. This allows a smoother experience for activities like logging in automatically or filling forms.

However, if the interaction with site1.com occurs in a less direct way, such as through an embedded image or AJAX request from site2.com, then the cookie won't be sent. It's mainly about enhancing security while still enabling a user-friendly browsing experience by recognizing your visits to familiar sites through direct navigation actions, like clicking a link.