CSRF attacks are a thing of the past. The default value for the SameSite attribute on a cookie is Lax which means the cookie won't be sent cross-site, rendering CSRF attacks useless.