Cookie SameSite SOP

Cookie SameSite SOP
Strict vs Lax vs None for session cookies. Choose by login flow.

— Use SameSite=Strict when: the cookie never needs to survive a cross-site navigation. Best for pure admin panels with no external login links.
— Use SameSite=Lax when: users arrive via external links that must keep them logged in (most public sites). Default in modern browsers.
— Use SameSite=None only with Secure and only for genuine cross-site contexts (embedded widgets, OAuth popups). It re-opens CSRF exposure, so pair with tokens.
— Add HttpOnly to every session cookie: blocks JavaScript theft via XSS.
— Verify: inspect Set-Cookie in DevTools, confirm Secure + HttpOnly + the right SameSite on the session cookie.

Run this when you configure auth.