
= SameSite Cookie Attribute
:description: Learn how to configure the SameSite Cookie attribute in {page-component-title} to relax the cookie enforcement policy.

The SameSite Cookie attribute controls access to cookies and helps prevent various cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks.
This attribute tells browsers how to handle first- or third-party cookies and identifies whether to allow a cookie to be accessed.

{page-component-title} ships with the most secure configuration (`strict`) for its session cookie.
This means that the session cookie will not be sent for any cross-site requests.
There may be environments where a user wants to relax this enforcement by setting the SameSite attribute to `lax`.

== Relax enforcement policy

To change the enforcement policy, you must edit `$OPENNMS_HOME/jetty-webapps/opennms/WEB-INF/web.xml`:
+
[source, xml]
----
<session-config>
  <cookie-config>
    <http-only>true</http-only>
    <secure>false</secure>
    <comment>__SAME_SITE_STRICT__</comment> <1>
  </cookie-config>
  <session-timeout>-1</session-timeout>
</session-config>
----
<1> Replace `__SAME_SITE_STRICT__` with `__SAME_SITE_LAX__` to change the enforcement policy to `lax`.

