chore: added a FAQ in the Documentation related to unsolicited response 403

Author: peppelinux

docs/source/contents/faq.md

@@ -26,3 +26,11 @@ case of a problem, much harder to debug.
 
 Following that pattern then I should import the application with
 import saml but unfortunately that module name is already used in pysaml2.
+
+**saml2.response.UnsolicitedResponse: Unsolicited response**
+
+If you are experiencing issues with unsolicited requests this is due to the fact that
+ cookies not being sent when using the HTTP-POST binding. You have to configure samesite
+ djangosaml2 middleware (see setup documentation) and also consider upgrading
+ to Django 3.1 or higher.
+If you can't do that, configure "allow_unsolicited" to True in pySAML2 configuration.

docs/source/contents/setup.rst

@@ -71,7 +71,7 @@ You can even configure the SAML cookie name as follows::
   SAML_SESSION_COOKIE_NAME = 'saml_session'
 
 Remember that in your browser "SameSite=None" attribute MUST also
-have the "Secure" attribute, which is required in order to use "SameSite=None".
+have the "Secure" attribute, which is required in order to use "SameSite=None"::
 
   SESSION_COOKIE_SECURE = True
 
@@ -80,7 +80,7 @@ have the "Secure" attribute, which is required in order to use "SameSite=None".
   djangosaml2 will attempt to set the ``SameSite`` attribute of the SAML session cookie to ``None`` so that it can be
   used in cross-site requests, but this is only possible with Django 3.1 or higher. If you are experiencing issues with
   unsolicited requests or cookies not being sent (particularly when using the HTTP-POST binding), consider upgrading
-  to Django 3.1 or higher.
+  to Django 3.1 or higher. If you can't do that, configure "allow_unsolicited" to True in pySAML2 configuration.
 
 Authentication backend
 ======================