Do 3rd party cookies open up the possibility of CSRF where it may not exist? I was looking at a blog post as well as an IETF draft on same-site cookies that make it seem like 3rd party cookies could make CSRF happen.
My confusion - CSRF happens when session cookies are present during an update request to the web application. Is this because session cookies could be 3rd party cookies? For CSRF to happen, you would still need a) the correct request structure b) session cookies. How do 3rd party cookies help CSRF? The only angle I can think of is that the "third party" would have probably CORS whitelisted the "first party" as a legal requestor domain. If the third party relies solely on Same Origin Policy for CSRF mitigation, then it might be in trouble.
Any possible attack scenarios would be highly appreciated!