Documented: CsrfDefenseStrategy in case of no support for SameSite cookie attribute
Use of CsrfDefenseStrategy in case of potential use of a browser version not
supporting the SameSite cookie attribute
Refer to
@@ -179,11 +179,15 @@ csrf.tokenName.nonAjax=
csrf.entity.request.limit=
# -- CSRF defense strategy.
-# -- Because OFBiz OOTB also sets the SameSite attribute to 'strict' for all cookies,
+# -- Because OOTB OFBiz also sets the SameSite attribute to 'strict' for all cookies,
# -- which is an effective CSRF defense,
# -- default is org.apache.ofbiz.security.NoCsrfDefenseStrategy if not specified.
# -- Use org.apache.ofbiz.security.CsrfDefenseStrategy
-# -- if you need to use a 'lax' for SameSiteCookieAttribute
+# -- if you need to use a 'lax' for SameSiteCookieAttribute.
+# --
+# -- Or if you, or your users, use, or may use, a browser version that
+# -- is not supporting the SameSite cookie attribute
+# -- You may refer to https://caniuse.com/#feat=same-site-cookie-attribute
csrf.defense.strategy=
