Some Cookie SameSite defaults changed to None

## Some Cookie SameSite defaults changed to None

SameSite is an option for cookies that can help mitigate some CSRF attacks. When this option was initially introduced inconsistent defaults were used across various AspNetCore APIs that has lead to confusing results. In 3.0.0-preview4 we've better aligned these defaults and made the feature opt-in on a per-component basis.

### Version introduced

3.0

### Old behavior

APIs defaulted to SameSiteMode.Lax.

### New behavior

APIs default to SameSiteMode.None.

### Reason for change

To make SameSite an opt-in feature.

### Recommended action

Each component that emits cookies need to decide if SameSite is appropriate for their scenarios. Review your usage of the affected APIs and reconfigure SameSite as needed.

### Category

ASP.NET

### Affected APIs

- [CookieOptions](https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookieoptions.samesite?view=aspnetcore-3.0#Microsoft_AspNetCore_Http_CookieOptions_SameSite) used with [HttpResponse.Cookies.Append](https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.iresponsecookies.append?view=aspnetcore-3.0#Microsoft_AspNetCore_Http_IResponseCookies_Append_System_String_System_String_Microsoft_AspNetCore_Http_CookieOptions_) has changed its default from `SameSiteMode.Lax` to `SameSiteMode.None`.
- [CookieBuilder.SameSite](https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.http.cookiebuilder.samesite?view=aspnetcore-3.0#Microsoft_AspNetCore_Http_CookieBuilder_SameSite) used as a factory for `CookieOptions` has changed its default from `SameSiteMode.Lax` to `SameSiteMode.None`.
- [CookiePolicyOptions.MinimumSameSitePolicy](https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.builder.cookiepolicyoptions.minimumsamesitepolicy?view=aspnetcore-3.0) has changed its default from `SameSiteMode.Lax` to `SameSiteMode.None`.



---
#### Issue metadata

* Issue type: breaking-change

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Some Cookie SameSite defaults changed to None #348