Consider adding None to the list of values for the SameSite attribute.

[mikewest]

Giving developers an explicit keyword that asserts non-SameSiteness seems like it's both helpful from an explanatory perspective, and could open paths towards tightening cookie behavior in the future. Perhaps something like SameSite=None to represent the status quo default behavior. That is, the following two Set-Cookie header values would produce the same cookie today:

name=value

name=value; SameSite=None