Does SameSite replace CSRF tokens?

For most apps, SameSite=Lax removes the need for a token on top-level POSTs, but defense-in-depth is still recommended.

cookies7 min readUpdated 2026-01-02

Cookie Security: SameSite, Secure, HttpOnly

Every authentication cookie should carry three attributes: Secure, HttpOnly and SameSite. Miss one and you have a vulnerability, not a bug.

The three attributes

Secure = only sent over HTTPS. HttpOnly = not readable from JavaScript, so XSS cannot steal it. SameSite=Lax or Strict = not sent on cross-site requests, killing most CSRF.

When to use SameSite=None

Only for cookies that legitimately need to be sent from a third-party context (embedded checkout, SSO). SameSite=None must be paired with Secure.

Frequently asked questions

Does SameSite replace CSRF tokens?: For most apps, SameSite=Lax removes the need for a token on top-level POSTs, but defense-in-depth is still recommended.

Try it on your site

Run a free Website Auditor scan and see which of these controls you're missing.

Run a scan

Cookie Security: SameSite, Secure, HttpOnly

The three attributes

When to use SameSite=None

Frequently asked questions

Try it on your site

Related tools

Cookie Security Checker

More guides

HTTP Security Headers: A Practical Guide