fix: Correct interpretation of SameSite=strict

[shimingw]

trafficstars

Description

In the Set-Cookie documentation, the explanation for SameSite=Strict is inaccurate.

The specification for SameSite=Strict adds two restrictions base on Lax restriction，but rel=prerender had deprecated，Therefore, there is only one restriction: top-level navigation scene.

Document address：https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-cookie-same-site-00#section-4.1.1

Motivation

Additional details

Related issues and pull requests

[github-actions[bot]]

Preview URLs

• /en-US/docs/Web/HTTP/Headers/Set-Cookie

(comment last updated: 2024-07-12 13:42:36)

[bsmth]

Thanks for the suggestion! I'm inclined to keep the original here as I think it's more accurate. Even though rel=prerender is deprecated, it's used as an example (of a category of attack*) that SameSite=Lax won't prevent, so this doesn't change the definition of SameSite=Strict, IMO. I'm going to close this one, but if you think I've made a mistake, please let me know! Thank you :)