My current setup: I have backend & frontend hosted on completely different domains. From backend I’m sending back an httpOnly cookie that contains session id. Frontend checks login status by hitting /user/status.

(As an aside, I know that session-based auth is not common in MERN stack apps, where JWT is preffered. I’m assuming my approach violates REST principles a bit. But for my use case, sessions are way more comfortable than fighting with limitations and edge cases of JWT)

I have CORS properly setup. My question is, having CORS set up and limiting incoming request content type to only application/json, is my website prone to CSRF attack at all? Since backend and frontend are on completely different domains, I have to set sameSite=None for the cookie to be sent, but to my understanding, it’s not an issue since CORS will block any malicious web requests from 3rd party websites.

Again, is it safe to assume that CORS completely eliminates CSRF attack possibility for my type of setup?