diff --git a/config-templates/config.php b/config-templates/config.php
index 8c466caaa80fe44292620c48c334536e08ef8cda..f76724ef981d8cfa945a599417a2aeaf318b74c3 100644
--- a/config-templates/config.php
+++ b/config-templates/config.php
@@ -564,6 +564,13 @@ $config = [
      * the RFC6265bis SameSite cookie attribute. If set to null, no SameSite
      * attribute will be sent.
      *
+     * A value of "None" is required to properly support cross-domain POST
+     * requests which are used by different SAML bindings. Because some older
+     * browsers do not support this value, the canSetSameSiteNone function
+     * can be called to only set it for compatible browsers.
+     *
+     * You must also set the 'session.cookie.secure' value above to true.
+     *
      * Example:
      *  'session.cookie.samesite' => 'None',
      */
diff --git a/docs/simplesamlphp-nostate.md b/docs/simplesamlphp-nostate.md
index 05d22776b7250c65d0cdd9f019316d3ccb77f33c..4f113a198c59c7fabdee39536c7ff253cd8f6927 100644
--- a/docs/simplesamlphp-nostate.md
+++ b/docs/simplesamlphp-nostate.md
@@ -112,6 +112,7 @@ assertion via the HTTP-POST binding.
 To resolve this, you can set the `session.cookie.samesite` attribute in `config.php`
 to `None`. Starting with SimpleSAMLphp 1.19, the config template contains a way to
 set this dynamically based on the user's browser support for this attribute.
+You also need to enable the `session.cookie.secure` setting.
 
 ### A generic problem saving sessions