SameSite=Lax doesn't protect you from login-CSRF | Xiliux Blog

SameSite=Lax doesn't cover login-CSRF, and we found it by setting three AI models to attack our own identity server: one raised a false alarm, another refuted it, and a third found the real bug.