> SameSite=Lax is now the default on browsers Note on all major browsers unfortunately: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#br

> SameSite=Lax is now the default on browsers Note on all major browsers unfortunately: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#browser_compatibility https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se... A real shame, because it would be a pretty robust solution for sites that don't require any cross-origin interactions at all. That being said it is well supported if set explicitly. So if you can ensure that all cookies that your app sets have the attribute you should be good to go.