@julian said in Hook for modifying session cookie:
Hi @asdrubalivan! That's an interesting conundrum you've got there...
...
However, it seems last last year, @oplik0 used sameSite: 'Strict' for API routes, or at least, those requiring the CSRF token.
Not a dev so don't follow most of this but my eyes did pick out the cross site and strict, and yes, necessary for CSRF. Seems trying to work around that would be less than advisable? I guess it ultimately depends on your security stance and cost/benefit but I'd be wary of circumventing. It's a freakin' war zone out there. And an election year for U.S. so expect community and blogger sites to be targeted vigorously and relentlessly.
My $0.02. We now return you to your regularly scheduled programming...
