Changing Session cookie - samesite v4.6.1

No, samesite is only changed to Lax if the passed $samesite is an empty string. Can you show your code that sets up the session cookie?

Sure, for brevity the comments have been removed. app/Config/Session.php is unchanged from the CI default version.

app/Config/Cookie.php

PHP Code:

class Cookie extends BaseConfig
{
    public string $prefix = '';
    public $expires = 0;
    public string $path = '/';
    public string $domain = '';
    public bool $secure = true;
    public bool $httponly = true;
    public string $samesite = 'None';
    public bool $raw = false;
} 


app/Controllers/BaseController.php

PHP Code:

    public function initController(RequestInterface $request, ResponseInterface $response, LoggerInterface $logger): void
    {
        parent::initController($request, $response, $logger); // do not edit this line
        $this->request = $request;

        $this->session = session();