Question: I have a web application with react in front-end and node in backend.

I am using passport authentication with passport-saml strategy. Since the last browser update i am seeing an issue. Once I try to login I was taken to the authentication page and it returned back to app page again, then auth page and this continues. looks like i was in a redirection loop.

Once I disabled the samesite attribute flag in chrome then the issue got resolved.

I read some articles and realized that the samesite attribute is causing this. (please correct me if i am wrong. Also want to know), where we will be adding this in backend.. I was using node express session module and addded a cookie object as :-

`cookie: {sameSite: 'none', secure: true}`

Can someone please help me to find a solution for this?

Answer: 
Is you application behind proxy server with ssl enabled?

I had a similar problem with similar setup and similar symptoms, but I've already switched from saml to oauth (without using passport), so I'm not sure if this helps you.

Anyway, there were two things I needed to do to keep a session cookie 'alive' over the requests.

1. Set 'trust proxy' in your server code: `app.set('trust proxy', 1)`
2. Set X-Forwarded-Proto header to proxy server config (mine is nginx):

```
    location / {
      proxy_set_header X-Forwarded-Proto $scheme;
      ...
    }

```
I'm not sure this is your case, but I'm assuming your app is deployed (I haven't faced this issue in localhost, so your problem may be somewhere else) and your session is being set.

After 3 days trying to figure It out. I finally found a way around this issue, **It's not a fix**, I'm quite sure PassportJS will come with a solution for that eventually, but for now It allowed me to get the user from the authentication.

Since we are not being able to get the user from the cookie, but the information is in the server session, the way to get this information is to add to the '**server.js**' a route to get the user directly from the server session:

```
app.get('/api/getUser', (req, res) => {
  res.json(req.session.user);
});

```

For some reason, I suppose the lack of cookie somehow, using the req.session inside of a router is returning undefined, but If used inside 'server.js' (or your server index file) It gets the session.

If you need the req.user.\_id or some other sensitive information for other requests, I would recommend returning a jwtToken with this information to the frontend (in res.json), then save the token directly in localStorage and pass the token in the body of your requests, is not the ideal, but It's the safer way I could think to keep the ids safe.