Lax + POST mitigation as well as the following Spring Security tickets:

• Change the default implementation of Saml2AuthenticationRequestRepository to store and load AuthnRequests based on the ID instead of the session #14013
• Receive AuthnRequest Id and Response InResponseTo in Saml2AuthenticationRequestRepository #11468

explain some of the difficulties around using SameSite=Lax or SameSite=Strict when using SSO technologies like SAML and others that redirect with a POST.

There are a few ways to consider:

• Provide an implementation of CookieSameSiteSupplier that writes the session cookie as SameSite=None pre-login and as SameSite=Strict post-login (Boot-specific solution)

• Have the session cookie always be SameSite=None and introduce a SameSite=Strict correlation cookie when authentication succeeds. The correlation cookie has a secure random value that must match a certain session attribute, lest the session be invalidated.

• Add a separate SameSite=None cookie whose opaque token references pre-login information, the opaque token could be the RelayState. It would be created when login begins and destroyed when login completes either successfully or unsuccessfully.

• Use the Artifact binding instead (SAML-specific). Such allows the redirect from the IdP to be a GET instead of a POST.