Set SameSite on session cookies
Why it matters
A session cookie without SameSite relies on each browser's default, and some still send it with cross-site requests that can trigger actions as the logged-in visitor. SameSite=Lax stops that for most cross-site requests while normal links keep working.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Stage 1: list flows where another site sends the visitor back to you with a POST and expects the session: single sign-on (SAML), some payment and 3-D Secure returns, embedded widgets. Those need SameSite=None; Secure on the cookie they use, or a change in the flow.
- Stage 2: set SameSite=Lax on the session cookie where it is created (PHP session.cookie_samesite = "Lax", Django SESSION_COOKIE_SAMESITE, Laravel same_site in config/session.php, Express cookie: { sameSite: 'lax' }), then test login, single sign-on and payment flows.
http
Set-Cookie: session=VALUE; Path=/; Secure; HttpOnly; SameSite=Lax Related
Scan your domain to see whether this applies to you.