SameSite must be strict or Lax at least shouldn't be None

[proffapt]

In this way only heimdall should be able to implement auth / request should be able to done by heimdall frontend only.

Maybe try, building the frontend and adding it onto docker image and host both onto metaKGP server.