Issue
The problem is happening when using POST method to receive data from another portal on a different domain, which is considered unsafe when request header is SameSite=LAX, that because if this header is not declared (as in our portal) then by default the browser is setting its value as LAX.
Because of this, the cookies gets rejected and if you look in the console, in the warning message "Indicate whether to send a cookie in a cross-site request by specifying its SameSite attribute" you will see that JSESSIONID is one of them: 
The situations in which Lax cookies can be sent cross-site must satisfy both of the following:
1. The request must be a top-level navigation. You can think of this as equivalent to when the URL shown in the URL bar changes, e.g. a user clicking on a link to go to another site.
2. The request method must be safe (e.g. GET or HEAD, but not POST).
For example:
- Let's say a user is on site-a.com and clicks on a link to go to site-b.com. This is a cross-site request. This is a top-level navigation and is a GET request, so Lax cookies are sent to site-b.com. However, Strict cookies are not sent because it is, after all, a cross-site request.
- The user is on site-a.com and there is an iframe in which site-b.com is loaded. This is a cross-site request, but it's not a top-level navigation (the user is still on site-a.com, i.e. the URL bar doesn't change when the iframe is loaded). Therefore, neither Lax nor Strict cookies are sent to site-b.com.
- The user is on site-a.com which POSTs a form to site-b.com. This is a cross-site request, but the method (POST) is unsafe. It doesn't meet the criteria for Lax cookies going cross-site, so neither Lax nor Strict cookies are sent to site-b.com
Environment
-
DXP 7.0 or higher
Resolution
If you don't have the possibility of using GET method in your case, then you could try to do a re-POST to your own domain as is it done in our portal in this filter class SamlSameSiteLaxCookiesFilter.java and be sure to use this component property:
"before-filter=Session Id Filter"
This ensures the filter it is processes ahead of any calls to 'HttpServletRequest.getSession(true)' as, you should avoid setting any cookie, because it is important that no new Session is created in the absence of self redirect, because then an overriding JSESSIONID cookie will get set resulting in the session being lost.
Additional Information
To add a new filter to our portal, you could use this page: Servlet Filters