I don’t understand how SameSite attributes work in cross-site Cookies. And probably I don’t understand how cross-site cookies work. I have a few questions, the answer to which will help me a lot.

I would be very grateful for links to articles or videos that will help me understand this subject.

Question 1

If the SameSite=strict attribute is set, Cookies will only be sent if the page domain and server domain are the same or if the request to the server comes from the page for which this Cookie was set?

Question 2

Are cookies related to the page for which they were set or to the server that set them?

Question 3

Scenario:

1. The page page.com makes a request to the server server.com
2. The server server.com sends a response with the header Set-Cookie: name=value; SameSite=strict

When Cookies will be sent:

1. If the request comes from the page for which the cookie was set, i.e. from page.com to server.com
2. If the domain of the page is the same as the server’s domain, i.e. from page.com to page.com
3. If the domain of the page is the same as the domain of the server that set the cookie, i.e. from server.com to server.com
4. The browser will prevent the cookie from being set

Question 4

Scenario:

1. The page page-1.com makes a request to the server server.com
2. The server server.com sends a response with the header Set-Cookie: cookie-1=value; SameSite=none; Secure
3. The page page-2.com makes a request to the server server.com
4. The server server.com sends a response with the header Set-Cookie: cookie-2=value; SameSite=none; Secure

Questions:

• If I make a request from page-3.com to server.com, will Cookies cookie-1 and cookie-2 be sent?
• If Cookies from step 2 and step 4 have the same name, will they overwrite each other?