[tordrt]

Yep SameSite lax, and just make sure you never perform any actions using Get requests, which you shouldn’t anyway.

[paulryanrogers]

Unsubscribe often need to be GET, or at least start as GET

[eli]

list-unsubscribe header sends a POST. Probably makes more sense to just use a token from an email anyway.