looks like spring-session added in a cookie seralizer for same site - but only since 2.1.0 https://docs.spring.io/spring-session/docs/current/api/org/springframework/session/web/http/DefaultCookieSerializer.html#setSameSite-java.lang.String-