IDP 5 - NoSuchConversationException when clicking URL link from email and _saml_idp cookie set.

[Cantor, Scott]

I actually missed that you specifically said SameSite=strict...and, yeah. That obviously wouldn't work and shouldn't.

The mitigations we added for SameSite were never meant to set the cookies to strict, but to none. If you go the other direction, you're definitely going to break it in a whole variety of scenarios, it's more than just this one case. If the IdP works at all, it's happenstance, and you'll definitely lose SSO in a lot of scenarios because it won't get the session cookie to establish the identity without a login.

The email thing is still inconsistent and that's just wrong, but I see why I was confused, I was thinking you meant "if you don't set SameSite to anything", rather than strict. We've tested lots of things when it's not set, but I doubt we spent much time on strict since it's not practical to use that given how SAML and OpenID work.

I would caution that any results you're getting now that "work" are likely accidents. Probably bugs in the browsers they haven't plugged yet to tighten it all up. It makes no sense that a cross-site request in one case (an email link) would honor the SameSite rule and a link on a web page elsewhere would not. Both are cross-origin.

-- Scott