> For the complete documentation index, see [llms.txt](https://docs.hackerspot.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hackerspot.net/web-security/web-vulnerabilities/cross-site-request-forgery/csrf-best-practices.md).

# CSRF Best Practices

* **Strict**:
  * Use `SameSite=Strict` for cookies containing sensitive information or those used in critical operations (e.g., authentication cookies).
  * Example:

    ```http
    httpCopy codeSet-Cookie: authToken=xyz789; Secure; HttpOnly; SameSite=Strict
    ```
* **Lax**:
  * Use `SameSite=Lax` for cookies that should generally be sent in same-site contexts but still allow some cross-site requests (e.g., navigations from external links).
  * Example:

    ```http
    httpCopy codeSet-Cookie: trackingId=def456; Secure; HttpOnly; SameSite=Lax
    ```
* **None**:
  * Use `SameSite=None` only when cross-site requests are necessary and ensure the `Secure` attribute is present to enforce HTTPS.
  * Example:

    ```http
    httpCopy codeSet-Cookie: thirdParty=ghi123; Secure; HttpOnly; SameSite=None
    ```