If this doesn't affect any of our components anyway, then why do the change from "most secure" at all? We'd still be broken.

The point here is that SameSite has been breaking arbitrary components that aren't aware of it so we're changing to an opt-in model. Our components have already opted in as far as they're able.

Opt-in to security is generally not the route we take though

If it was a stable security feature I'd agree, but it's not, Apple keeps breaking it.

So now I ask the impossible, if it's affecting other components can I get an idea of how widespread this is?

We have three datapoints:

1. The CookiePolicy SameSite default broke all remote auth and had to be disabled in the templates. People still regularly break this if they don't have that line.
2. Anyone calling Response.Cookies.Append also defaulted to Lax. There haven't been as many direct reports of this issue.
3. Anyone using Lax on IOS is broken and they've had to disable it everywhere. We've gotten a lot of hits on this one and it's not just auth cookies, it affects session, app cookies (See 2), etc..

This change fixes the first two. It doesn't fix the 3rd.

OK fair, I submit :)

@Tratcher please rebase on master ASAP. This is failing due to a flaky test that has been skipped in master

/azp run AspNetCore-helix-test

Azure Pipelines successfully started running 1 pipeline(s).