flawopen.com/CSRF/SameSite cookies

Does SameSite=Strict replace CSRF tokens?

Reference page — draft, pending review
Short answer

It closes most of the gap for modern browsers, but it's not a complete substitute — it depends entirely on cookie-based session auth, and edge cases (older browsers, certain navigation patterns) still exist. Most security guidance recommends both as defense-in-depth.

What SameSite actually does

A SameSite=Strict cookie is never sent on a cross-site request — including the classic CSRF pattern of an attacker's page auto-submitting a form to your site. This directly neutralizes the mechanism CSRF depends on: the browser silently attaching your session cookie to a forged request originating elsewhere.

Where it still falls short

Auth methods other than cookies aren't covered

If your app authenticates via a bearer token stored in a header (not a cookie), SameSite is irrelevant — the browser doesn't attach headers the way it attaches cookies, so this specific defense doesn't apply to that authentication model at all.

SameSite=Lax (the modern default) still allows top-level GET navigation

Only Strict blocks cookies on every cross-site request; Lax (many browsers' default when unspecified) still sends cookies for top-level GET navigations, which can matter if a state-changing action is ever reachable via GET.

Older or non-compliant clients don't enforce it

SameSite is enforced by the browser — a client that doesn't support or respect the attribute provides no protection, which is part of why defense-in-depth (CSRF tokens as a backstop) is still commonly recommended.

FAQ

Is a CSRF token needed for GET requests?

See the dedicated page on this — short answer: state-changing actions should never be reachable via GET in the first place, which sidesteps the question.

References