Dotnet: Add SameSite Cookie Property

[AlleSchonWeg]

Hi,
This descripes the request: https://github.com/aspnet/Security/issues/908
Please add this for .net framework 4.7.x
Thanks

[Tratcher]

Specifically to https://msdn.microsoft.com/en-us/library/system.net.cookie(v=vs.110).aspx in support of CookieContainer, HttpWebRequest, and HttpClient?

[AlleSchonWeg]

Hi,
for me it's important to set the flag serverside in an asp.net webforms app. It should be configurable in web.config like requireSSL etc:

<system.web>
  <httpCookies httpOnlyCookies="true" requireSSL="true" domain="xxx" SameSite="strict/lax" />
</system.web>

Specifically to https://msdn.microsoft.com/de-de/library/system.web.httpcookie(v=vs.110).aspx in support of HttpResponse, HttpRequest. :)

[Enjeej]

Hello,

Is there any news about this feature request? For us this would also be a highly appreciated feature

[brainbug89]

Any update on this?

According to this comment: https://stackoverflow.com/questions/38954821/preventing-csrf-with-the-same-site-cookie-attribute#comment88140579_38957177 it's already built in .NET Framework 4.7.2 but it doesn't work for me?!

[seanwm]

This still appears to be missing. If you use a DelegatingHandler to manually set a cookie in 4.7.2, you must add a CookieHeaderValue using response.Headers.AddCookies(). But CookieHeaderValue still doesn't have a SameSite property. Chrome 80 is due in less than a month so this is going to start being a problem for people very soon.

[Tratcher]

@seanwm Comments on closed issues are not tracked, please open a new issue with the details for your scenario.

You seem to be referring to a different set of APIs than the rest of this issue, specifically the System.Net.Http.Formatting APIs. CookieHeaderValue is defined in its own package over at https://github.com/aspnet/AspNetWebStack/blob/master/src/System.Net.Http.Formatting/Headers/CookieHeaderValue.cs, it's not part of the .NET or .NET Core runtimes. Opening an issue in AspNetWebStack would be a good start.

How do you anticipate SameSite impacting your WebApi scenario? WebApi's A) largely don't use cookies, and B) don't do the kind of redirects that would trigger SameSite protections.

[tmenier]

Specifically to https://msdn.microsoft.com/en-us/library/system.net.cookie(v=vs.110).aspx in support of CookieContainer, HttpWebRequest, and HttpClient?

For anyone looking for that: #1232