Glossary
SameSite Cookie Attribute
The SameSite cookie attribute controls whether a browser attaches a cookie to a request that originates from a different site than the one the cookie belongs to. Restricting this reduces a specific, common attack surface where a malicious page tricks a user's browser into sending an authenticated request to another site the user happens to be logged into, since the browser can be told not to attach that session cookie to a cross-site request in the first place.
This is a narrow, specific control on cookie behavior, not a general access-control mechanism — much like CORS, it protects against one particular scenario involving a browser mediating between sites, and a request that doesn't go through a browser's cookie-attachment logic at all is entirely unaffected by whatever this attribute is set to.