In general, CSRF protection means this: "compare
<input type=hidden> with a value in user's session" (or sometimes - user cookie).
Now, suppose I want my app/website to be iframe compatible (while still protecting from CSRF "session-riding" attacks).
However, newer browser versions will disable setting a cookie inside iframes. Chrome has this in their roadmap for 2021 and they are already enforcing this in incognito tabs (see this answer)
Which means, that every navigation event inside an iframe (clicking a link or POST-ing a form) creates a new Session ID (because the
Set-Cookie: MY_FRAMEWORKS_SESSION_ID will be ignored by the browser).
So... What do we do? How do we stay iframe-friendly, while still preventing CSRF?
(apart from "do not use iframes" answer)