SameSite cookie
SameSite affects cookie inclusion in cross-site requests. The choice must fit login and navigation flows; CSRF protection remains necessary.
Limit when a cookie is sent
The cookie attribute SameSite controls inclusion in requests between different sites. This classification uses the scheme and registrable domain. A site is not the same as an origin with its full host and port. Thus https://portal.example.com and https://api.example.com are the same site but different origins. This alone does not let browser code read the API response.
Consider navigation in the portal design
A fictional portal considers entry through a link on another website. With SameSite=Strict, the session cookie is not sent on this cross-site entry. Explicitly setting SameSite=Lax allows the cookie to be sent during top-level navigation with a safe method such as GET, subject to the other cookie conditions. This does not automatically include the cookie in embedded requests or arbitrary state-changing calls.
With SameSite=None, this SameSite restriction is removed; Secure is additionally required. Other cookie conditions remain. The attribute adds protection against certain CSRF attacks; it does not replace suitable CSRF defenses or server-side permission checks.
The team must check login, return flows and any embedding within the planned process. No single choice for every portal is prescribed here.
Sources
Related terms
- HttpOnly cookieHttpOnly prevents direct cookie access by page scripts. Matching requests can still carry the cookie; session and permission checks remain necessary.
- Cross-site request forgery (CSRF)CSRF exploits a signed-in session for an unwanted request. A session cookie alone does not prove that the user intended the action.
- Cross-Origin Resource SharingCORS controls browser access to responses across origin boundaries. It replaces neither API login nor permission checks.
- Data minimisationData minimisation limits personal data to what is adequate, relevant and necessary for a defined purpose.
- Data retention policyA data retention policy defines the purpose, start, duration and end of storage. Deletion jobs and copies must be addressed in the implementation.
- Envelope encryptionEnvelope encryption separates the data key from the key protecting it. The encrypted file and wrapped data key need to be managed together.
Your project with ASES
Describe your project to us. We will get back to you with an initial assessment.