It will fail securely, which is what you want. The alternative is to have it fail insecurely and bypass validation for everything. In the latest versions the f

It will fail securely, which is what you want. The alternative is to have it fail insecurely and bypass validation for everything. In the latest versions the framework sets the SameSite header properly, so you don't need the CSRF middleware at all (you can just remove it).