Lax skips the cookie on cross-site POSTs and sub-requests but sends it on normal top-level navigation; Strict is tighter; None needs Secure.
SameSite
A cookie attribute that limits when the browser sends the cookie on cross-site requests.
Lax skips the cookie on cross-site POSTs and sub-requests but sends it on normal top-level navigation; Strict is tighter; None needs Secure.