controller.rb

if current_user&.samesite_lax_enabled?
  SecureHeaders.use_secure_headers_override(request, :samesite_lax)
end

security_headers.rb

SecureHeaders::Configuration.default do |config|
  config.cookies = {
    samesite: {
      none: { only: ["saml_csrf_token", "saml_return_to"] },
    }
  }
end

SecureHeaders::Configuration.override(:samesite_lax) do |config|
  config.cookies = {
    samesite: {
      lax: { except: ["saml_csrf_token", "saml_return_to", "saml_csrf_token_legacy", "saml_return_to_legacy"] },
      none: { only: ["saml_csrf_token", "saml_return_to"] }
    }
  }
end