Lax was not enough
The session cookie is explicitly SameSite=Lax, which everyone reads as "cross-site requests do not carry it".
A page on an unrelated site pointed a top-level navigation at an endpoint that changes state — a plain link, or a form submitted with GET — and the cookie went along with it.
Lax is not "never cross-site". It is "not on subresources, and not on unsafe methods — but yes on a top-level navigation using a safe method". That exception exists so the redirect back from your identity provider still lands you logged in.
Boundaries, outermost first: your origin: Delete endpoint (mutates on GET; FAILED: mutates on a safe method), an empty slot for the what a state change must use, an empty slot for the proof it came from your page Outside every boundary: Top-level navigation (safe method), Another site, Session cookie (SameSite=Lax), IdP redirect back (must keep working) Connections: Another site calls Top-level navigation (step 1) Top-level navigation calls Delete endpoint — cookie goes with it (step 2) Session cookie controls Top-level navigation — attached by the browser IdP redirect back controls Top-level navigation — also top-level what a state change must use controls Delete endpoint (step 3) proof it came from your page controls Delete endpoint (step 4)