The actual answer should be, as always: it depends on your usage scenario.
Strict value will prevent the cookie from being sent by the browser
to the target site in all cross-site browsing context, even when following a regular
link. For example, for a GitHub-like website this would mean that if a logged-in user
follows a link to a private GitHub project posted on a corporate discussion forum
or email, GitHub will not receive the session cookie and the user will not be able
to access the project. A bank website however most likely doesn't want
to allow any transactional pages to be linked from external sites so the
would be most appropriate here.
Lax value provides a reasonable balance between security
and usability for websites that want to maintain user's logged-in session after
the user arrives from an external link. In the above GitHub scenario, the session cookie
would be allowed when following a regular link from an external website while blocking
it in CSRF-prone request methods (e.g.