Our policy was set to samesite = strict and most everything was working.

However one SSO (openId) login was not playing nicely.

User starts at ourdomain.com/login, hits the SSO button and gets redirected to azuredomain.com and logs in.

azuredomain.com redirects back to our ssoprocessing.com which processes the token exchange, and sorts out login tokens etc.

ssoprocessing.com then redirects to ourdomain.com/login which checks tokens and creates a session cookie.

ourdomain.com/login then redirects to the final dashboard page where they should be logged in, however the session is lost during the final redirect from ourdomain.com/login to ourdomain.com/dashboard.

Why is that, the cookie is being set on the same domain and this exact same process works for other openId sso logins, also with azure but different tenants.

all works fine when samesite=lax.

Its confusing me (not hard), not least because other SSO implementations work ok using the same code/flow

Thanks all