Per mine understanding, by default same origin policy(SOP) is enabled by default by all browsers. This means that a web browser permits scripts contained in a first web page to access data in a second web page, but only if both web pages have the same origin.
My question is do we need to handle CSRF attack separately with the CSRF token as SOP is in place. I see almost all websites mitigates it by CSRF token implementation buy why it is required when SOP is in place ?
I see another related cookie “SameSite=strict” at this blog to prevent CSRF . To me it looks like SOP which is provided by browser by default. So is it really required ?