www-samesite verified
SameSite attribute on the session cookie
in the configuration this is a line
www-samesite: …SameSite policy applied to the console's session cookie.
Values
- Values
strict · lax · none- applying
restart required- where it can be set
in the config file · with a startup flag · as an environment variable
In detail
Decides whether the browser sends the console session along with requests originating from other sites — the standard defence against a logged-in operator being made to act by a page they merely visited. The effective value is a built-in nobody states, which on a panel that can pause a customer's sending is worth establishing rather than assuming.