IDP 5 - NoSuchConversationException when clicking URL link from email and _saml_idp cookie set.

[Dan McLaughlin]

It's my understanding that the Sec-Fetch-Site header can't be changed,
it's created by the browser based on the origin of the request because
it's how the browser knows if the originating request was cross-origin
or not.

--

Thanks,

Dan

On Mon, Nov 27, 2023 at 10:27 AM Cantor, Scott <cantor.2 at osu.edu> wrote:
>
> > I have found a solution to the issue we were facing. The problem was
> > that the original request to access a protected resource had come from
> > an email link, which had caused the browser to set the Sec-Fetch-Site
> > to cross-origin.
>
> I guess it's possible this is an evolution of the original email link bug I mentioned, and perhaps they're not resetting the Sec-Fetch-Site header "soon enough" in the sequence of redirects and such to get things to work. Sort of a "private browsing context" by header policy rather than actually a separate process context.
>
> That would seem to fit the symptoms. We have open issues around the whole "Office document links" problem and the behavior has never exactly made a lot of sense, but this might be the problem I suppose.
>
> -- Scott
>
>