Spent an absolutely infuriating day fighting my OIDC implementation because direct sign-in was working, but hitting an [Authorize]'d endpoint kept ending up in a redirect loop. Turns out Same-Site cookies also look at the Referer domain in redirects! https://www.nogginbox.co.uk/blog/strict-cookies-not-sent-by-request I cannot thank you enough for writing this up, @nogginbox