Browsers attach cookies to every request for your domain, even when the request was triggered by a page on someone else's site. That is what makes cross-site request forgery possible: a malicious page can make your logged-in user's browser send a request that carries their session cookie. SameSite lets the cookie itself refuse to travel in those cases.
Strict sends the cookie only for requests that begin on your own site. Lax also sends it when a user clicks a normal link to your site, which keeps login sessions working when people arrive from email or search. None sends it everywhere and must be paired with Secure. Modern browsers treat a cookie with no SameSite value as Lax, but you should not rely on that default.
AI tools often generate auth code that sets a cookie with no options, or copies a snippet with SameSite=None so an embedded widget works locally and never tightens it. Set the value on purpose: Lax for most session cookies, Strict for sensitive ones, None only when you truly need cross-site use. SameSite reduces CSRF but is not a replacement for CSRF tokens on state-changing routes.
Set-Cookie: session=abc123; Path=/; Secure; HttpOnly; SameSite=Lax