If the users browser doesn’t have samesite, you’ve got much bigger problems that JWTs wont solve.