How to add CSRF cookie directive?
It is actually possible but it's a little bit difficult for beginners. You'll need make use of Service Locators and overwrite craft\web\Response to change this method

foreach ($this-&gt;getCookies() as $cookie) {
    $value = $cookie-&gt;value;
    if ($cookie-&gt;expire != 1 &amp;&amp; isset($validationKey)) {
        $value = Yii::$app-&gt;getSecurity()-&gt;hashData(serialize([$cookie-&gt;name, $value]), $validationKey);
    }
    setcookie($cookie-&gt;name, $value, $cookie-&gt;expire, $cookie-&gt;path, $cookie-&gt;domain, $cookie-&gt;secure, $cookie-&gt;httpOnly);
}


setcookie is the key here, because if you use it like that, you can't really include the parameter, so you need call it accordingly with options

setcookie ( string $name [, string $value = "" [, array $options = [] ]] ) : bool


Each yii\web\Cookie only has the following Attributes

public $name;
public $value = '';
public $domain = '';
public $expire = 0;
public $path = '/';
public $secure = false;
public $httpOnly = true;


Since there is no sameSite attribut you have to think about an intelligent way to set it. There is already a feature request for it. Maybe it's easier to ask about the current status.