Redirect loop when using session cookie same_site strict

[mintalicious]

It's more of a hint than an issue.
After a pentest of our webapp which resulted in a recommendation using SameSite strict for cookies, we encountered an issue by a new user, who has a favorites.html with a link to the webapp. When he tried to get to the app, the request ended in a redirect loop between the callback and login routes and Keycloak.

I found out, that using 'same_site' => 'strict' in config/session.php leads to these redirect loops when the request of the page originates from a hyper link. The reason seems to be the session handling of Laravel (laravel/framework#31442 (comment)).
So we changed back to SameSite lax.

Maybe, this could be mentioned in the FAQs - it took me half a day to find that out.

Regards
Erik