Recently most browser have added support to the
SameSite cookie attribute to prevent CSRF attacks: https://www.owasp.org/index.php/SameSite
Question if it is supported should we implement Synchronizer Token Pattern to prevent CSRF attacks? https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Synchronizer_Token_Pattern
SameSite prevent at least same CSRF attacks as Synchronizer Token Pattern?
I do know that SameSite options are
lax and probably we will use the
Is the CSRF attack possible if we use only SameSite setting (without Synchronizer Token Pattern) in a browser that supports the setting (https://caniuse.com/#search=Samesite)?
What is a possible attack scenario?
(the question is not related to the XSS attack, only to the CSRF attack)