title: How can I restore a session from a Cross-Site Request where the session cookie uses SameSite?
body: <p><a href="https://blog.chromium.org/2019/10/developers-get-ready-for-new.html" rel="nofollow noreferrer">Google have said</a> that they will add the <code>SameSite=Lax</code> attribute to cookies by default in February 2020. In preparation, we have started testing using <code>SameSite=Lax</code> with all our cookies, including our session cookie (<code>PHPSESSID</code>).</p>
  
  <p>We have come across a problem where we redirect our users to WorldPay so they can add their bank account. WorldPay then POST back to our website with the details of the new account. The problem is, that because this is a Cross-Site Request, when the user comes back to our site, their browser does not load the session cookie and so they are logged out of our website.</p>
  
  <p>I'm just wondering if there's a best practice on how to deal with this. <code>SameSite</code> protects against Cross-Site Request Forgery attacks. In our case, our Cross-Site Request is not a Forgery or an attack, so we want to do the equivalent of whitelisting the request.</p>
  
  <p>I'm thinking we can store the session id in the database before we send the user to WorldPay, then restore the session using the previous session id when they come back. Of course, the challenge is knowing the person that came back is the same person that left. I'm thinking we can do that by setting a <code>SameSite=None</code> cookie with a secret token, and re-check that token on the return.</p>
  
  <p>This issue must be a common "problem" in the new age of <code>SameSite</code> cookies. I'm interested in hearing how you solved it?</p>