It's not a working warranty : forum only (i put a warning in manual in some minutes)

Else : https://www.sondages.pro/iframe/
tested in Chrome (broken if you disable external cookies)
tested on Edge

Case pf each samesite are different : https://manual.limesurvey.org/Optional_settings#Allow_usage_of_session_and_Csrf_Validation_in_iFrame_.28New_in_3.24.3_.29

'samesite' => 'None', for cookieParams
'SameSite' => 'None', for csrf

Thank you very much, in my case it still didn't work because we have php version 7.2.4 and the Session cookie got the samesite value to None but the csrf token didn't.

After comparing the two files, I have seen that in the CHttpSession.php there is a workaround incorporated for older versions of php that is not incorporated in CHttpRequest.php. I have added the same workaround to CHttpRequest.php and now it works ok.

The workaround is in addCookie function and the modified fuction code is

protected function addCookie($cookie)
{
$value=$cookie->value;
if($this->_request->enableCookieValidation)
$value=Yii::app()->getSecurityManager()->hashData(serialize($value));
if(version_compare(PHP_VERSION,'7.3.0','>='))
setcookie($cookie->name,$value,$this->getCookieOptions($cookie));
elseif(version_compare(PHP_VERSION,'5.2.0','>='))
{
// Work around for setting sameSite cookie prior PHP 7.3
// https://stackoverflow.com/questions/39750906/php-setcookie-samesite-strict/46971326#46971326
//Added by ndespujol

                    $pathcookie=$cookie->path. '; samesite='.$cookie->sameSite;
                    setcookie($cookie->name,$value,$cookie->expire,$pathcookie,$cookie->domain,$cookie->secure,$cookie->httpOnly);
                    }
            else
                    setcookie($cookie->name,$value,$cookie->expire,$cookie->path,$cookie->domain,$cookie->secure);

    }

This same function is included also in yiilite.php, but I have not seen any impact in changing it, so I assume this file is not used in limesurvey,

I have also discovered that both the Session and the Request samesite attributes could be normalized to the same "samesite" by changing the

public $sameSite=self::SAME_SITE_LAX;

to

public $samesite=self::SAME_SITE_LAX;

in the CHttpCookie.php file

That would need to change also the GetCookieOptions function corresponding parameter name at the end of the file CHttpRequest.php (the same holds for yiilite.php).