Cookies - Add support for SameSite attribute

[rzontar]

Since .Net Framework 4.7.2 adds support for the SameSite attribute OWIN should support it too.
I believe implementing it in the Microsoft.Owin.ResponseCookieCollection and CookieManager should be straightforward. But don't know whether it's possible to set it in the SystemWebCookieManager, without compiling to .Net 4.7.2.

[yuriyostapenko]

A temporary workaround for auth cookie under IIS

This is of course limited and depends on what other cookies you might have to set, but...

If you host in System.Web (4.7.2), you can set something like

<system.web>
    <httpCookies sameSite="Lax" />
</system.web>

in Web.config

and then add

CookieManager = new SystemWebChunkingCookieManager()

to your CookieAuthenticationOptions

[muratg]

@blowdart thoughts here?

[blowdart]

If you're signing up to do new features then yea I suppose so. Framework got it.

[maximelian]

I think I found a bug here, when my cookie size exceeded max size and I have

<system.web>
    <httpCookies sameSite="Lax" />
</system.web>

CookieManager = new SystemWebChunkingCookieManager()

then I got "incomplete cookie" error and lost first chunk.
However if I set cookie manager like:

CookieManager = new SystemWebChunkingCookieManager { ChunkSize = 4000 }

(By default it is 4090) all works just fine. Also tested with size 2000 so I got 3 chunks and all worked as well.

My guess is that SameSite property value, that goes to cookie, does not took in account while chunking cookie, so cookie size is over supported size, which lead to missing cookie chunk problem.

[Tratcher]

SameSite is included in SystemWebChunkingCookieManager's math, but only when SameSite is applied in app code, not when applied in the web.config (it can't see that).

Why are you using the web.config httpCookies setting?

[maximelian]

Good question. Didn't find how I can do it in code.
Any suggestions? I am using Owin CookieAuthenticationExtensions.

[Tratcher]

A new option was added for 4.1.0:
https://github.com/aspnet/AspNetKatana/pull/308/files#diff-5df72023cbd21f64c7f53a8cb8de98deR72