SameSite=Strict is the CSRF defence: several owner routes act on a GET, so a cross-site
navigation carrying the cookie could install a module. Strict sends it on no cross-site request,
top-level links included.
Parameters
token: string
secure: boolean
false only for a plain-http local dev origin, where a Secure cookie is dropped
The
Set-Cookieline that signs an operator in.SameSite=Strictis the CSRF defence: several owner routes act on a GET, so a cross-site navigation carrying the cookie could install a module. Strict sends it on no cross-site request, top-level links included.