Cookies & SameSite
curl -v https://app.example.com prints one line you typed and one the browser adds without asking: a header carrying a value the server handed you on an earlier response, replayed now on its own, with no code re-sending it.
- ▸One URL pair, two verdicts: the read is blocked as cross-origin, yet the cookie still rides to the neighbor subdomain.
- ▸Do nothing and the cookie still vanishes when another page loads yours: the silent 2020 default change stripped it.
- ▸Reach for the most permissive value and the browser still discards the cookie unless you also lock it to https.
A server answers your request with an extra line: Set-Cookie: session=9f3a; Path=/. You did nothing with it. Yet run curl -v against the same host again and a line you never wrote appears in what you send: Cookie: session=9f3a. The browser stored the value the server handed back and replayed it, unasked, on the next request to that host. A cookie is that round-trip: the server writes it once with Set-Cookie, the client returns it on every later request in the Cookie header, and nothing in your code re-sends it.
Change the host you request and the replay stops. The browser attaches a stored cookie only to requests headed back to the host that set it.