PHP setcookie “SameSite=Strict”?

Question

I recently read \"RFC 6265\" on the attribute \"Same Site\", I looked at some articles that talked about that in April 2016, \"same-site\" attribute has been implemented for

Answer 1

There are a lot of examples showing how to set this attribute, but not many explanations of why.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#SameSite_attribute

If a cookie is needed to be sent cross-origin, opt out of the SameSite restriction by using the None directive. The None directive requires that the Secure attribute also be used.

The examples that are setting SameSite to None or Lax are only appropriate for cross-domain scenarios. If your code isn't cross-domain, use Strict.