If the SameSite attribute is set to Strict, then the browser will not include the cookie in any requests that originate from another site. This is the most defensive option, but it can impair the user experience, because if a logged-in user follows a third-party link to a site, then they will appear not to be logged in, and will need to log in again before interacting with the site in the normal way.
If the SameSite attribute is set to Lax, then the browser will include the cookie in requests that originate from another site but only if two conditions are met:
- The request uses the GET method. Requests with other methods, such as POST, will not include the cookie.
- Imagine we have a very bad design and all our actions are performed on GET method. The attacker placed link saying "Save puppies" which links to
http://oursite.com/users/2981/delete