title: Does setting cookies 'SameSite=none; Secure' and providing CSRF-TOKEN suffice to prevent CSRF in embeddable web application?
body: <p>My web application (myApp further) is embedded in iframe of a single third-party webpage. MyApp sets cookie <code>Set-Cookie: JSESSIONID=38FE580EE7D8CACA581532DD37A19182; Path=/myapi; Secure; HttpOnly</code> for maintaining users sessions. Sometime ago it stopped working in Chrome since <a href="https://blog.chromium.org/2020/02/samesite-cookie-changes-in-february.html" rel="nofollow noreferrer">https://blog.chromium.org/2020/02/samesite-cookie-changes-in-february.html</a> update changed treating default behaviour for cookies without <code>SameSite</code> attribute from <code>None</code> to <code>Lax</code>.</p>
  <ol>
  <li><p>I'm going to send cookies from myApp host with <code>SameSite=None; Secure</code>. Also <code>X-CSRF-TOKEN</code> header is included in every response. myApp javascript gets <code>X-CSRF-TOKEN</code> and puts it in header of every XHR request to myApp host. Does this suffice to prevent CSRF attack?</p>
  </li>
  <li><p>Should <code>Access-Control-Allow-Origin: third-party-webpage</code> header be added in responses?</p>
  </li>
  </ol>