People rely on browsers not being able to POST a JSON body to a (cross-origin) API to prevent cross-site request forgery. Maybe this is obsolete in a SameSite=

People rely on browsers not being able to POST a JSON body to a (cross-origin) API to prevent cross-site request forgery. Maybe this is obsolete in a SameSite=Lax by default world, but simply allowing browsers to support a JSON enctype has consequences that need to be carefully thought through. If you wanted browsers to do this properly, you'd probably need to send a pre-flight?