title: Samesite=Strict cookies are not included in 302 redirects when user clicks link from a different domain
body: <ol>
  <li>A customer will link to one of our webpages on their site:  customer.site/links.html</li>
  <li>A person clicks that link and gets sent to our.site/webapp/handlerequest.aspx?someparam=somevalue</li>
  <li>The value of <code>someparam</code> is set in a cookie with <code>SameSite=Strict</code> and then uses a 302 redirect to <strong>another page on the same domain</strong>:</li>
  </ol>
  <pre><code>Request URL: https://our.site/webapp/handlerequest.aspx?someparam=somevalue
  Request Method: GET
  Status Code: 302 
  Remote Address: ...
  Referrer Policy: strict-origin-when-cross-origin
  
  cache-control: private
  content-length: ...
  content-type: text/html; charset=utf-8
  date: ...
  location: /webapp/someotheraction
  server: Microsoft-IIS/10.0
  set-cookie: someparam=somevalue; expires=Thu, 17-Mar-2022 14:41:13 GMT; path=/; secure; HttpOnly; SameSite=Strict
  strict-transport-security: max-age=31536000
  x-frame-options: SAMEORIGIN
  </code></pre>
  <p>The browser does <strong>NOT</strong> include this cookie on the 302 redirect to /webapp/someotheraction.</p>
  <p>This only starting happening when we specifically change our code to set this cookie to <code>SameSite=Strict</code>.</p>
  <p>This occurs in Chrome, Firefox, Edge, and IE (old IE)</p>
  <p>Is this on purpose?  Why?  Since we are going from one request on the domain to another request in the same domain, shouldn't the <code>SameSite=Strict</code> cookies be included?  Does this have anything to do with the referer policy defaulting to <code>strict-origin-when-cross-origin</code>? <a href="https://www.w3.org/TR/referrer-policy/" rel="nofollow noreferrer">https://www.w3.org/TR/referrer-policy/</a> doesn't say anything about cookies</p>