C# – SameSite Cookie attribute ommited by ASP.NET Core

asp.net-coreccookies

I am trying to explicitly set SameCookie attribute of the cookie with ASP.NET Core to None.

The way I tried to do this was to set property value of CookieOptions like this:

var options = new CookieOptions
{
    SameSite = SameSiteMode.None
};

(other attributes omitted for brevity)

However when I examine server response headers (where server is supposed to set the cookie with SameSite=None) I can see SameSite is omitted. On the contrary I can see Value, Expires, Path even Secure stated explicitly.

If I set SameSite in C# code to Lax or Strict I can see it explicitly included in Set-Cookie header. If I set it to None – I cannot.

I did check on two browsers – Firefox and Chrome 77 (I am aware of changes that this version introduces to SameSite).

There is a hack to include SameSite=None. You just need to add following line to Path property of CookieOptions:

options.Path += "; samesite=None";

Then it can be found in Set-Cookie header of the response.

Is there a way to configure Kestrel (no IIS used for hosting, bare Kestrel) to include SameSite=None in headers without hacking it like this?

Best Answer

It looks like the issue is that while the SameSite Enum has a None value that's interpreted as the default value of simply not providing a SameSite attribute. You can see this in the code for SetCookieHeaderValue which only has token values for Strict and Lax.

To set a SameSite=None; Secure cookie you should send the Set-Cookie header yourself.

(Side note: I'll try to sort out a pull request for the core to add proper None support)

Related Topic