diff --git a/server/configs/application.properties b/server/configs/application.properties
index 365ce22ce9..9e69cd353f 100644
--- a/server/configs/application.properties
+++ b/server/configs/application.properties
@@ -117,6 +117,19 @@ mail.smtpUser=@@smtpUser@@
 # HTTP session timeout for users - defaults to 30 minutes
 #server.servlet.session.timeout=30m
 
+# SAML IdPs return authentication assertions via a cross-site POST. Without an explicit SameSite value,
+# Chrome browser treats JSESSIONID as Lax and withholds it from that POST, except during a grace period covering
+# cookies less than two minutes old. Reauthentication deliberately never replaces the session -- the
+# signed-in session is what it verifies against -- so the cookie only ages, and any reauthentication more
+# than a couple of minutes after sign-in arrives with no session cookie. That fails two ways: the request
+# looks like a guest, producing a misleading "wrong user reauthenticated" error, and the response mints a
+# guest session whose Set-Cookie overwrites the signed-in JSESSIONID, logging the user out. SameSite=None
+# keeps the session attached to the callback and is only honored on Secure cookies,
+# so this requires HTTPS.
+#server.servlet.session.cookie.same-site=none
+#server.servlet.session.cookie.secure=true
+#server.servlet.session.cookie.http-only=true
+
 ## Turn on JSON-formatted HTTP access logging to stdout. See issue 48565
 ## https://tomcat.apache.org/tomcat-9.0-doc/config/valve.html#JSON_Access_Log_Valve
 #jsonaccesslog.enabled=true