FrontendHaltSecurity·Intermediate·Conceptual·1 min read
Why does SameSite matter even in a token-based system?
Short interview answer
If refresh tokens or any session-establishing value is stored in a cookie, SameSite still controls whether that cookie is sent on cross-site requests, so CSRF exposure isn't eliminated just because access tokens are sent via headers.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.