5 ms·
Why is the default lax instead of strict?
by zeroimpl 7y ago
Why is the default lax instead of strict?
- rosybox 7y agoBecause strict would break how people expect the internet to work. Any links from a third party website to a site where the session cookie is set with SameSite strict, clicking those links will not include the session cookie for that site. For example, if GitHub implemented SameSite strict for its session cookie and you clicked a link on a site that took you to GitHub, it would not send the cookie for GitHub and it will look like you're not logged in on GitHub, even though if you opened a new tab and went to GitHub you would be logged in. https://www.owasp.org/index.php/SameSite https://www.owasp.org/index.php/SameSite
- zeroimpl 7y agoAh so Strict is super strict, whereas Lax is still stricter than the current default. Lax seems like it should have been named something else, like Partial or Moderate.