I'm under the understanding that in 2019, Chrome and Firefox both planned to move to SameSite=lax default for all unspecified cookies. In addition, recently, Chrome decided to set defaults based on other information such as the 'secure' flag, and whether or not communications were sent over HTTPS. My understanding is that Chrome has since backflipped on this,
Can SameSite be relied on as an effective control against CSRF for HTTP POST requests? If a cookie does not have no SameSite directives and the website have no other anti-CSRF, should it be considered a vulnerability?
Are there any other impacts relevant to samesite in modern, and historic browsers? Does IE11 support SameSite? What about IE11 on Windows 7 (noting that for some reason, Microsoft decided to not implement/disable CSP on Win7/IE11), What about when using unencrypted HTTP or when the secure flag is not set (I ask because other Chrome cookie behavior seems dependent on this facto)? Is there any other unexpected behaviors of samesite?