Search code examples
asp.net.netweb-configforms-authenticationsamesite

Send Forms Authentication Cookie with explicit samesite=none

I have been able to do this transition for the session cookie but not for the login cookie enter image description here

and I have the following web.config

    <authentication mode="Forms">
      <forms name="MyCookie" loginUrl="~/Login/login.aspx" timeout="30" slidingExpiration="true" cookieless="UseCookies" cookieSameSite="None" protection="All" requireSSL="true" defaultUrl="~/Login/DefaultRedirect.aspx" enableCrossAppRedirects="false" path="/" />
    </authentication>

if I change cookieSameSite="None" to cookieSameSite="Lax" or strict. I can see that the change takes place, but it seems to still have the old behavior of not emiting the samesite value when set to None

I'm using .net framework 4.7.2 and have installed the server update that allowed me to do the session with samesite=none

Solution

  • turn out I was missing sameSite="None" <httpCookies

    so now I have : <httpCookies httpOnlyCookies="true" requireSSL="true" sameSite="None" />

    <authentication mode="Forms">
  <forms name="MyCookie" loginUrl="~/Login/login.aspx" timeout="30" slidingExpiration="true" cookieless="UseCookies" cookieSameSite="None" protection="All" requireSSL="true" defaultUrl="~/Login/DefaultRedirect.aspx" enableCrossAppRedirects="false" path="/" />
</authentication>