Not able to retrieve user profile after signing in with passport-azure-ad and session cookie sameSite strict

Question

I am building a NodeJS application with passport-azure-ad and openidconnect strategy for Microsoft login. Despite setting the cookie session sameSite to strict, I'm not getting the user profile after sign-in. It works fine with sameSite=lax.

Answer 1

Hi @Gonzalo Espinosa , when the sameSite attribute is set to strict, the browser will only send the cookie in a first-party context, which means that the cookie will only be sent to the same site that set it. This can cause issues with cross-site authentication flows, such as the one used by passport-azure-ad. This document details possible solutions.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James