Scenario 1: Working fine
The application receives all the requests through Azure App Gateway. The application sets some value for the session cookie "JSESSIONID" in the response of first "/login" endpoint (set by Spring security). This same JSESSIONID cookie value is then used in the request header of "/login?code=<some_code>&state=<some_state>" api, which is the callback url from the Authorisation server. So, in this case, the auth server is able to identify the client based on same session cookie value. We can infer that Azure app Gateway sends the cookie forward. There is no specific settings done in App Gateway.
Scenario 2: Issue
Now the application receives the request through Azure App Gateway from Apigee. The callback url is also set to the apigee url. The application sets some value for the session cookie "JSESSIONID" in the response of first "/login" endpoint. But when the callback url "/login?code=<some_code>&state=<some_state>" is invoked after Auth server validation success, there is no "JSESSIONID" in the request header. So, possibly Apigee is stripping of this cookie.
The other cookies like "SameSite", "ADRUM_BTa" and "ADRUM_BT1" are passed in the request header of the callback url in both the scenarios.
Could someone please help here, if there is any settings change that needs to be done in Apigee so that it sends the cookie in the request header of callback url.
This was resolved by setting the session cookie path in the Application equal to the URI backend path of the Apigee configuration.
server.servlet.session.cookie.path=/backend/path/configured/in/apigee/proxy
As the session cookies are always set based on path. By default, without the above code, the session cookie path was set to the server context path of the application.