IDP 5 - NoSuchConversationException when clicking URL link from email and _saml_idp cookie set.

[Cantor, Scott]

> The problem was consistent across every browser we tried. If the
> Sec-Fetch-Site=cross-origin header is on the request...

Does the IdP actually see that header? I assume so.

It sounds like we should log it, because whatever is doing this is just plain broken (and if every browser is broken, all that does is prove I was right a long time ago about that).

We have ample experience running IdPs without any SameSite adjustments, and SPs that route directly to the IdP have never had this sort of problem before. It seems like the trick to this is understanding why/when they send that header, so logging it probably is a first step to getting a better grasp of that.

It's possible that things are just way worse than they used to be and something's changed. I haven't run my IdP without SameSite in quite a while, so it's certainly possible it isn't optional to handle that anymore even for routine cases.

-- Scott