Have a customer asking about this. I see Tomcat supports it here. https://tomcat.apache.org/tomcat-9.0-doc/config/cookie-processor.html
We currently use defaults, so I'm looking for an XML fragment and the file it goes in to add the samesite attribute to the JSESSIONID. I'm assuming they want it globally for all webapps. Thanks Dave
