diff --git a/lib/ravel.js b/lib/ravel.js
index <HASH>..<HASH> 100644
--- a/lib/ravel.js
+++ b/lib/ravel.js
@@ -99,6 +99,7 @@ class Ravel extends AsyncEventEmitter {
     this.registerParameter('session max age', true, null);
     this.registerParameter('session secure', true, true);
     this.registerParameter('session rolling', true, false);
+    this.registerParameter('session samesite', true, null);
     // Passport parameters
     this.registerParameter('app route', false, '/');
     this.registerParameter('login route', false, '/login');
@@ -275,9 +276,10 @@ class Ravel extends AsyncEventEmitter {
       httpOnly: true, /* (boolean) httpOnly or not (default true) */
       signed: true, /* (boolean) signed or not (default true) */
       secure: this.get('https') || this.get('session secure'), /* (boolean) secure or not (default true) */
-      rolling: this.get('session rolling') /* (boolean) Force a session identifier cookie to be set on every response.
+      rolling: this.get('session rolling'), /* (boolean) Force a session identifier cookie to be set on every response.
                          The expiration is reset to the original maxAge, resetting the expiration
                          countdown. default is false */
+      sameSite: this.get('session samesite') /** (string) session cookie sameSite options (default null, don't set it) */
     };
     app.use(session(sessionOptions, app));
Ensure samesite can be set on downstream applications