Configuration support for SameSite cookie attribute

Last published : Sep 03, 2026
The SameSite attribute indicates the browser whether the cookie can be used for cross-site context or only for same-site context. If an application intends to be accessed in the cross-site context then it can do so only via the HTTPS connection. For details, see RFC6265.
Until Feb 2020, the SameSite attribute was not explicitly set in the NetScaler appliance. The browser took the default value (None). The non-setting of SameSite attribute did not impact the NetScaler Gateway and NetScaler AAA deployments.
With certain browsers upgrade, such as Google Chrome 80, there is a change in the default cross-domain behavior of cookies. The SameSite attribute can be set to one of the following values. Default value for Google Chrome is set to Lax. For certain version of other browsers, the default value for SameSite attribute might still be set to None.
  • None: Indicates the browser to use the cookie in cross-site context only on secure connections.
  • Lax: Indicates the browser to use the cookie for requests on the same-site context. In the cross-site context, only safe HTTP methods like GET request can use the cookie.
  • Strict: Use the cookie only in the same site context.
If there is no SameSite attribute in the cookie, the Google Chrome assumes the functionality of SameSite = Lax. As a result, for deployments within an iframe with cross-site context that require cookies to be inserted by the browser, Google Chrome does not share cross site cookies. As a result, the iframe within the website might not load.
A new cookie attribute named SameSite is added to the VPN and NetScaler AAA virtual servers. This attribute can be set at the global level and at the virtual server level.
To configure SameSite attribute, you must perform the following:
  1. Set the SameSite attribute for the virtual server
  2. Bind cookies to the patset (if the browser drops cross-site cookies are dropped by the browser)

Setting the SameSite attribute by using the CLI

To set the SameSite attribute at the virtual server level, use the following commands.
set vpn vserver VP1 -SameSite  [ STRICT | LAX | None ]
set aaa vserver VP1 -SameSite  [ STRICT | LAX | None ]
To set the SameSite attribute at the global level, use the following commands.
set vpn param VP1 -SameSite  [ STRICT | LAX | None ]
set aaa param VP1 -SameSite  [ STRICT | LAX | None ]
Note: The virtual server level setting takes preference over the global level setting. Citrix recommends setting the SameSite cookie attribute at the virtual server level.

Binding cookies to the patset by using the CLI

If the browser drops cross-site cookies, you can bind that cookie string to the existing ns_cookies_SameSite patset so that the SameSite attribute is added to the cookie.
Example:
bind patset ns_cookies_SameSite "NSC_TASS"
bind patset ns_cookies_SameSite "NSC_TMAS"

Setting the SameSite attribute by using the GUI

To set the SameSite attribute at the virtual server level:
  1. Navigate to NetScaler Gateway > Virtual Servers.
  2. Select a virtual server and click Edit.
  3. Select the edit icon in the Basic Settings section and click More.
    Click More in Basic Settings
  4. In SameSite, select the option as required.
    Set SameSite check box
To set the SameSite attribute at the global level:
  1. Navigate to NetScaler Gateway > Global Settings > Change Global Settings.
  2. Click the Security tab.
  3. In SameSite, select the option as required.
    Select SameSite check box