Signing into RealMe loses session data in SilverStripe

[torleif]

Module version(s) affected

5.3.2

Description

The default Session variable in SilverStripe 5 has the SameSite=Lax setting enabled.

SameSite Cookie Policy: The SameSite=Lax setting allows cookies to be sent with cross-site GET requests but not POST requests. Since the RealMe return uses a POST request, the session cookie is not sent back, causing the session to reset.

How to reproduce

1. Create a session variable in your SilverStripe instance.
2. Sign in to RealMe
3. Your session will be reset

Possible Solution

Change the default cookie settings, or enable a way to pass through additional data

Additional Context

No response

Validations

• Check that there isn't already an issue that reports the same bug
• Double check that your reproduction steps work in a fresh installation of silverstripe/installer (with any code examples you've provided)

[GuySartorelli]

When you say "Your session will be reset" - what are the actual effects of that? What problems does this cause, specifically?