__host-jsessionid changes inappropriately

[Nabeelah Azam, Fnu]

We did an in-place upgrade from idp v4 to v5 & post our upgrade we've few users running into a stale request issue. All these users in common have the value of __Host-JSESSIONID cookie value changing on them between the first http-post binding to the next redirect to the execution=e1s1 page. There's no session timeout occurring between these redirects, nor are they being redirected to a different server between these attempts. Once, the user runs into a situation as above, unless the cookies are not deleted out of their browser history, they receive stale requests upon hitting any other SP.

We do not customize our web.xml and I can confirm that we've the default settings configured under there as below.
    <session-config>
        <session-timeout>15</session-timeout>
        <cookie-config>
            <!-- Comment name and path to revert __Host- protection. -->
            <name>__Host-JSESSIONID</name>
            <path>/</path>
            <secure>true</secure>
            <http-only>true</http-only>
        </cookie-config>
        <tracking-mode>COOKIE</tracking-mode>
    </session-config>

In our idp-properties configuration we have the following properties configured
idp.cookie.sameSite = None

^ Apart from this, is there anything that we are missing configuration wise? There's no easy way to reproduce this issue on our end, hence we are at a loss as to what might be causing this.

Thanks,

Nabeelah Azam
Systems Administrator | IT at Sam

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240815/4148e78f/attachment.htm>