I'm hosting an Angular app on http://app.localhost URL. Where am checking, setting and modifying an authentication related cookie on initial page load, login and logout API calls. Cookie's SameSite attribute has value "Strict". I'm also hosting a simple webpage on http://127.0.0.1:5000 URL. It consist of an anchor tag which redirects to http://app.localhost. So, when I'm loading the page by entering http://app.localhost URL in the browser, the cookie is being sent from the backend, which is expected. But when am opening http://app.localhost page on clicking on anchor tag (link) present on http://127.0.0.1:5000 page (i.e. opening the page through redirect), then also cookie is being sent from the backend, which is not expected in case of "SameSite: Strict". Ref.: https://stackoverflow.com/a/59995877/16760422 https://web.dev/articles/samesite-cookies-explained#use-samesite Please correct me if I'm misunderstanding "SameSite: Strict". And why cookie's behavior is not as expected? Continue reading...