Using the SameSite attribute, you can restrict the Set-Cookie HTTP response header to first-party or same-site contexts. This feature is available only in secure contexts (HTTPS) in most browsers.

You can set the SameSite cookie attribute to the lax, strict, and none values. If the SameSite attribute is not specified explicitly, the default cookie value is set to lax.

The ActiveVOS user interface is used in guides that can be embedded in third-party web applications. To embed guides in a third-party web application, you must set the SameSite attribute value to none and not strict. If you do not use guides or use guides only in the ActiveVOS application and not in third-party applications, you can use strict mode for protection. For more information about the SameSite cookie values, see SameSite cookie values.

A user with the administrator role for the ActiveVOS server can control the SameSite cookie attribute in the following ways: