In PingAccess, the SameSite attribute for the session cookie (PA.user) is a global setting that dictates browser behavior for cross-site requests. This critical security setting is configured centrally within the Web Sessions section of the administrative console. This allows administrators to enforce a consistent session cookie policy (e.g., Lax, Strict, or None) across all applications and user sessions managed by that PingAccess instance, enhancing protection against cross-site request forgery (CSRF) attacks.

A. Rules: Rules are used to define the logic for granting or denying access to resources, not for configuring session cookie attributes.

B. Sites: Sites define the backend web servers that PingAccess protects; they do not control the properties of the PingAccess session cookie.

C. Applications: Applications define the specific resources being protected, but the fundamental behavior of the session cookie is managed globally under Web Sessions.

1. Ping Identity PingAccess 7.3 Administrator's Guide, Section: "Configuring Web Sessions". The configuration table in this section explicitly lists the "SameSite Cookie" setting and its available options (Disabled, Lax, Strict, None), confirming its location within the Web Sessions menu. (Accessed via Ping Identity Documentation portal).