Session cookie missing SameSite
A session-like cookie does not set SameSite.
Why it matters
SameSite limits when the browser attaches the cookie to a request that started on another site, which is the usual CSRF path.
What to do
Set SameSite=Lax or Strict.
Reference
Cookie attributes such as Secure, HttpOnly, and SameSite protect session tokens in browsers.