Given CSRF protection, how can I deal with an extremely slow user?

1. Is SameSite cookie enough for CSRF?
2. Does JWT protect against CSRF?

Is SameSite cookie enough for CSRF?

SameSite works by enabling browsers and website owners to limit which cross-site requests, if any, should include specific cookies. This can help to reduce users' exposure to CSRF attacks, which induce the victim's browser to issue a request that triggers a harmful action on the vulnerable website.

Does JWT protect against CSRF?

If you put your JWTs in a header, you don't need to worry about CSRF. You do need to worry about XSS, however. If someone can abuse XSS to steal your JWT, this person is able to impersonate you.