Misleading log message caused by SameSite cookie policy

[ghost]

Hi there.

I've been hunting down an OpenID issue in our company's product - setting the JSESSIONID cookie SameSite policy to 'strict' prevents the OpenID connect flow from working - the Authorization Endpoint responds, but the cookie is filtered from the response, and Tomcat doesn't find the existing session. That's pretty much as expected, but it causes the following code in BaseOpenIDConnectAuthenticator.performAuthentication to get a null for the session request, and so to provide a misleading log message and an 'instant' 408 Timeout response. Would it be worth adjusting the log message to eg. "could not retrieve session information: either user took so long to log on that the session expired, or Tomcat could not retrieve session details"? Could maybe help someone else having the same issue.

Cheers.

final Session session = request.getSessionInternal(false);                                                                                                                                                                                                                                                            
if (session == null) {                                                                                                                                                                                                                                                            
                                                                                                                                                                                                                                                              
    // log using container log (why container?)                                                                                                                                                                                                                                                            
    this.log.debug("user took so long to log on the session expired");