Restricting when a browser attaches a session cookie
The SameSite cookie attribute controls whether a browser attaches a cookie to a request originating from a different site than the one the cookie belongs to. Restricting this closes a specific, common attack surface where a malicious page tricks a victim's browser into sending an authenticated request to another site the victim happens to be logged into — the attacker never needs to see or steal the session cookie itself, only get the victim's own browser to attach it automatically to a request the malicious page triggers.
Setting this restrictively by default is one of the more effective, low-cost defenses against this specific class of attack, precisely because it doesn't depend on the victim noticing anything suspicious — the browser simply declines to attach the cookie to the cross-site request in the first place, regardless of how convincing the malicious page was.
A narrow control, not a general one
Like CORS, this is a narrow, browser-enforced control on one specific scenario — a browser mediating between sites — not a general access-control mechanism. A request that doesn't go through a browser's cookie-attachment logic at all, such as a direct server-to-server call, is entirely unaffected by whatever this attribute happens to be set to, which is exactly why session security still needs real, server-side authorization behind it regardless of how this attribute is configured.