I am debugging a problem with a legacy ASPNETCore authentication system that uses IdentityServer4. It seems to be a problem with how Chrome (and Edge) handles a cookie.

When the Login page POSTS the user’s credentials, the Login endpoint responds with a 302 redirect to a callback URL on the same server (/connect/authorize/callback). This response contains 3 new cookies:

• .AspNetCore.Identity.Application : path=/; secure; samesite=lax; httponly
• idsrv.session : path=/; secure; samesite=none
• idsrv : expires= Tue, 30 Apr 2024 14:29:35 GMT; path=/; secure; samesite=none; httponly

With Firefox, the browser then sends a request to the callback URL. That request includes all 3 of these cookies, and everything works.

But with Chrome or Edge, the request to the callback URL does not include the idsrv cookie, so that request fails and my users are sent back to the Login page.

Why wouldn’t Chrome include a cookie that it has just received?

I have tried setting SameSite=Lax on the idsrv cookie, but that has no effect.