Callback in ASP.NET Core with auth cookies

SameSiteMode.None is not just unreliable, it's insecure.

Instead of relying on cookies, why not use a State query parameter which contains a token/claim? Then catch that query parameter in the middleware, decode/validate it and apply the correct authentication and authorization.

This is the method that many OAuth callbacks use.

When setting cookies with strict mode, cookies are not set on redirecting. So, in order for the cookies to be set, the page needs to be viewed to the end-user in the browser allowing the cookies to be set.

An approach to this is to redirect using a form post instead of 302 redirect. By rendering an actual page at the end of the authentication process, you're breaking out of the redirect sequence allowing the browser to set the cookie:

Hope this helps?

Yes, just as @Charlieface indicates, IdentityServer also just redirects to the returnUrl with a query-parameter containing the code