Set SameSite on session cookies on Shopify
Why it matters
A session cookie without SameSite relies on each browser's default, and some still send it with cross-site requests that can trigger actions as the logged-in visitor. SameSite=Lax stops that for most cross-site requests while normal links keep working.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
Not possible on Shopify. Shopify sets the storefront's own cookies and stores cannot change their attributes. If the cookie belongs to an installed app, ask the app's developer.
Related
Scan your domain to see whether this applies to you.