How to add CSRF cookie directive? I need to add the SameSite directive to my site's CSRF cookie, as explained in these mozilla security guidelines. According to the Craft docs, "Craft handles the cookie creation automatically." Is there a way I can configure the cookie?
It is actually possible but it's a little bit difficult for beginners. You'll need make use of Service Locators and overwrite craft\web\Response to change this method

foreach ($this-&gt;getCookies() as $cookie) {
    $value = $cookie-&gt;value;
    if ($cookie-&gt;expire != 1 &amp;&amp; isset($validationKey)) {
        $value = Yii::$app-&gt;getSecurity()-&gt;hashData(serialize([$cookie-&gt;name, $value]), $validationKey);
    }
    setcookie($cookie-&gt;name, $value, $cookie-&gt;expire, $cookie-&gt;path, $cookie-&gt;domain, $cookie-&gt;secure, $cookie-&gt;httpOnly);
}


setcookie is the key here, because if you use it like that, you can't really include the parameter, so you need call it accordingly with options

setcookie ( string $name [, string $value = "" [, array $options = [] ]] ) : bool


Each yii\web\Cookie only has the following Attributes

public $name;
public $value = '';
public $domain = '';
public $expire = 0;
public $path = '/';
public $secure = false;
public $httpOnly = true;


Since there is no sameSite attribut you have to think about an intelligent way to set it. There is already a feature request for it. Maybe it's easier to ask about the current status.