How to set sameSite=None in Asp.Net MVC generated cookies?

Question

I have an asp.net MVC application and I want to set all the cookies sameSite=None for the application. I have set the below lines in the web.config but the application sets the cookies without SameSite=None. I have added the below two configurations in the web.config. See the below screenshot having both .AspNet.ApplicationCookie and __RequestVerificationToken cookies placed without sameSite=None. Please help.

<system.web>
        <httpCookies requireSSL="true"/>
        <sessionState cookieSameSite="None"/>
</system.web>

Eassa Nassar · Accepted Answer · 2021-08-15 12:00:38Z

4

i did it from the code and it worked
in global.asax.cs:

 public class MvcApplication : HttpApplication
                {
                
                   protected void Application_PreSendRequestHeaders(object sender, EventArgs e)
                   {
        .....
                        if (Request.Cookies.Count > 0)
                        {                        
                            foreach (string s in Request.Cookies.AllKeys)
                            {
                                HttpCookie c = Request.Cookies[s];
                                c.SameSite = System.Web.SameSiteMode.None;
                                Response.Cookies.Set(c);
                            }
                       }
        ....
                    }
                }

if you want for specific cookie

 if (Request.Cookies.Count > 0)
            {
                foreach (string s in Request.Cookies.AllKeys)
                {
                    if (s.ToLower() == "__requestverificationtoken")
                    {
                        HttpCookie c = Request.Cookies[s];
                        c.SameSite = System.Web.SameSiteMode.Strict;
                        Response.Cookies.Set(c);
                    }
                }
            }

answered Aug 15, 2021 at 12:00

Eassa Nassar

1,3001 gold badge16 silver badges19 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Ian GM Over a year ago

massive THANK YOU!! I have been battling with this issue for such a long time. All the Microsoft solutions I have tried just do not work. This is simple, makes sense, and most importantly, it works. I am using MVC .NET 4.7.2 and your solution has save me. Again, THANK YOU!!!

Collectives™ on Stack Overflow

How to set sameSite=None in Asp.Net MVC generated cookies?

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related