intermediate
SameSite cookies
Use SameSite, Secure, HttpOnly, domain, path, expiry, and credentialed fetch settings to reason about session behavior.
`SameSite` controls whether cookies attach to cross-site requests — the primary defense against CSRF for cookie-based sessions.
| Value | Cross-site GET | Cross-site POST | Notes | |-------|----------------|-----------------|-------| | Strict | No | No | Strongest; breaks some deep links | | Lax | Top-level navigation only | No | Default in modern browsers | | None | Yes (with Secure) | Yes | Needed for embedded cross-site flows |
Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax; Path=/
Credentialed `fetch(..., { credentials: 'include' })` requires matching CORS and cookie attributes. Third-party analytics or SSO iframes often force `SameSite=None; Secure`.
On interviews: explain why login works from a bookmark but AJAX from another subdomain fails; plan migrations when browsers tighten defaults.
Common pitfalls: missing Secure with SameSite=None; expecting cookies on cross-origin XHR without credentials mode; subdomain cookie scope too broad.
The trade-off is balancing simplicity, performance, safety, and operability — name which axis you optimized and what cost you accepted.
Checklist:
- Choose SameSite per flow (first-party vs embedded).
- Always pair None with Secure.
- Align CORS credentials with cookie policy.
- Test OAuth and payment redirects end-to-end.