What happens if I do not set SameSite?

The answer

It depends on the browser. MDN says some browsers use Lax as the default when SameSite is missing, and that this default is a more permissive Lax which also sends the cookie on cross-site POST requests within two minutes of it being set. Because the behaviour has had exceptions and may change, set the value explicitly on every cookie: Lax for ordinary session cookies, Strict for high-risk areas, None with Secure only for real cross-site needs.