Session stores other than `ActionDispatch::Session::CookieStore` (including `CacheStore`, `MemCacheStore`, and third-party stores based on `AbstractStore`, `AbstractSecureStore`, or session mixins) write session cookies without a `SameSite` attribute. This occurs regardless of the `config.action dispatch.cookies same site protection` setting. In browsers that do not default missing attributes to `SameSite=Lax`, cross-site requests may include the session cookie. This can lead to cross-site request forgery (CSRF) against actions that do not verify authenticity tokens, such as those in API-only applications. The issue affects applications using a session store other than `CookieStore` that do not explicitly provide the `same site:` option to `config.session store`.