Great article. Thanks for the explanation. Re: your section under "Why", it's worth mentioning that the default same-site value for cookies is lax, which means CSRF attacks aren't an issue because the cookie won't be sent cross-origin, unless the developer purposely changed the default value.