A Deep Dive Into SameSite Cookies, What They Are and Why They Matter
summary
Explains how browsers now interpret SameSite cookie values and what breaks: Chrome defaults to SameSite=Lax by default (rollout completed in mid‑2020), SameSite supports Strict, Lax and None, and Chrome requires Secure required for None (HTTPS) or it drops the cookie. Demonstrates with a homemade cookie tester and automated matrix showing GET/POST/iframe behavior, highlights Lax+POST two-minute grace used to preserve some auth flows, and contrasts behavior across browsers — Chrome vs Firefox differences (Firefox not enforcing None+Secure or defaulting Lax yet).
AI-written summary · about
chapters (25)
- 0:00Introduction
- 0:24What are SameSite Cookies
- 2:20What are crosssite request forgery attacks
- 4:52What is CSRF protection
- 7:48Can you use SameSite
- 8:14SameSiteStrict
- 9:52SameSiteNone
- 12:36Story Time
- 13:33Browser Console
- 13:53Google
- 14:51Enable SameSite by Default
- 16:00February 2020
- 16:18April 2020
- 17:45July 2020
- 21:11SameSite Plus Post
- 22:13What is a SameSite Domain
- 22:48What is a Public Suffix List
- 23:59Browser Demo
- 24:49Manual Tester
- 29:11Automated Tester
- 31:53Firefox
- 33:38Chrome
- 34:19Incognito
- 37:39What option do you use
- 40:00Is samesite lacks by default dead
