Glossary: Endpoint, Application and Email Security

SameSite

Also written: SameSite=Strict, SameSite=Lax, SameSite=None

A cookie attribute that controls whether the cookie is sent on requests that start on another site, which defends against CSRF. Strict never sends it, Lax sends it only on normal top-level link clicks, and None always sends it (and needs Secure).