What is the primary consequence of setting the ‘SameSite’ attribute to ‘None’ on a cross-site cookie?

Question

Web Development — Hard

What is the primary consequence of setting the ‘SameSite’ attribute to ‘None’ on a cross-site cookie?

Accepted Answer

Setting 'SameSite=None' disables the browser's default CSRF protection for cross-site requests. This allows the cookie to be sent in third-party contexts, such as cross-site images or iframes. Browsers require the 'Secure' attribute to be present alongside 'SameSite=None'. Options B and C describe 'Lax' or 'Strict' behavior, while D is a misconception about cookie security attributes.