Which mechanism does the browser use to handle ‘SameSite=Lax’ cookies during cross-site top-level navigations?

Question

Web Development — Hard

Which mechanism does the browser use to handle ‘SameSite=Lax’ cookies during cross-site top-level navigations?

Accepted Answer

SameSite=Lax cookies are sent only when the user navigates to the origin site (e.g., clicking a link). They are withheld on cross-site subrequests like images or frames, and on cross-site POST requests, to mitigate CSRF attacks. Option B is incorrect as POST is not a safe method. Option C is incorrect because top-level navigations are permitted. Option D is incorrect as it applies to standard navigation.