Browser/speculation rules prerender likely next page — instant navigation when correct, wasted bandwidth/CPU when wrong.

Caching & Networking

Speculative prerendering

<h2>Summary</h2>
<p><strong>Strict</strong> — no cross-site send (best CSRF, breaks some OAuth flows). <strong>Lax</strong> — top-level GET navigation only (default, balanced). <strong>None</strong> — requires Secure; cross-site embeds/APIs. <code>HttpOnly</code> + <code>Secure</code> for session cookies. Complements <a href="#18-cors-preflight">1.8 CORS preflight</a> and CSRF defenses.</p>
<h2>Code example</h2>
<pre><code class="language-http">Set-Cookie: session=abc123; Path=/; HttpOnly; Secure; SameSite=Lax
# Strict: no cross-site send
# None: requires Secure, allows cross-site embeds
</code></pre>
<h2>Key points</h2>
<ul>
<li><strong>Strict</strong> — no cross-site send (best CSRF, breaks some OAuth flows).</li>
<li><strong>Lax</strong> — top-level GET navigation only (default, balanced).</li>
<li><strong>None</strong> — requires Secure; cross-site embeds/APIs.</li>
<li><code>HttpOnly</code> + <code>Secure</code> for session cookies.</li>
<li>Complements <a href="#18-cors-preflight">1.8 CORS preflight</a> and CSRF defenses.</li>
</ul>
<h2>Further reading</h2>
<ul>
<li><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite">Set-Cookie SameSite</a></li>
<li><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies">Cookie security</a></li>
</ul>
<h2>Related concepts</h2>
<ul>
<li><a href="/blogs/level-5-priority-hints">Priority hints</a></li>
<li><a href="/blogs/level-5-speculative-prerendering">Speculative prerendering</a></li>
</ul>


**Strict** — no cross-site send (best CSRF, breaks some OAuth flows).

SameSite cookie modes

`fetchpriority="high"` on LCP image; `low` on below-fold.