Use samesite=strict because we don't need the cookie for page loads.

paskia/fastapi/session.py

@@ -70,7 +70,7 @@ def set_session_cookie(response: Response, token: str) -> None:
         httponly=True,
         secure=True,
         path="/",
-        samesite="lax",
+        samesite="strict",
     )