Answered by:
Chrome Samesite Problem

Question
-
User-549756379 posted
Hi,
I update my google chrome and visual studio to last stable version now I have problem to delete my cookie
Everything configured SameSite Like " sessionState to cookieSameSite="None" requireSSL="true" "
All cookie set on
https is On
SameSite = SameSiteMode.None
Secure = true
But chrome send this error :
Mark cross-site cookies as Secure to allow setting them in cross-site contexts
Cookies marked with
SameSite=None
must also be marked withSecure
to allow setting them in a cross-site context. This behavior protects user data from being sent over an insecure connection.Resolve this issue by updating the attributes of the cookie:
- Specify
SameSite=None
andSecure
if the cookie is intended to be set in cross-site contexts. Note that only cookies sent over HTTPS may use theSecure
attribute. - Specify
SameSite=Strict
orSameSite=Lax
if the cookie should not be set by cross-site requests
other Browser has no problem everything work fine,
plz guide me
Thanks
Wednesday, July 29, 2020 8:51 AM - Specify
Answers
-
User-939850651 posted
Hi O.Masnournia,
I created a simple example of this problem, created a cookie in Index, and deleted it in Welcome. In fact, it was successfully deleted.
But when I change the Secure property to false, it will not be able to delete cookies.public IActionResult Index() { var cookieOptions = new CookieOptions { Secure = true, HttpOnly = true, SameSite = SameSiteMode.None }; Response.Cookies.Append("test", "test value", cookieOptions); //var value = HttpContext.Request.Cookies["test"]; var cookieValue = Request.Cookies["test"]; ViewData["cookieValue"] = cookieValue; return View(); } public IActionResult Welcome() { Response.Cookies.Delete("test", new CookieOptions { Secure = true, HttpOnly = true, SameSite = SameSiteMode.None }); var cookieValue = Request.Cookies["test"]; ViewData["cookieValue"] = cookieValue; return View(); }
Index page: <h1>Index</h1> <h2>@ViewData["cookieValue"]</h2> <a href="/user/Welcome">to welcome page</a> Welcome page: <h1>Welcome</h1> Cookie: <b> @if (ViewData["cookieValue"] == null) { <label>Cookie has deleted</label> } else { <label>@ViewData["cookieValue"]</label> } </b>
So I think you need to double check whether the correct attribute value is set for it.
If possible, please provide more information, including relevant sample codes and related settings.
Best regards,
Xudong Peng
- Marked as answer by Anonymous Thursday, October 7, 2021 12:00 AM
Friday, July 31, 2020 10:18 AM -
User-549756379 posted
Yes,
var cookie = Request.Cookies["CookiName"];
cookie.Secure = true;
cookie.SameSite = SameSiteMode.None;
cookie.Expires = DateTime.Now.AddYears(-1);
cookie.Value = "";
HttpContext.Current.Response.Cookies.Add(cookie);- Marked as answer by Anonymous Thursday, October 7, 2021 12:00 AM
Friday, July 31, 2020 10:21 AM
All replies
-
User-939850651 posted
Hi O.Masnournia,
O.Masnournia
I update my google chrome and visual studio to last stable version now I have problem to delete my cookieAccording to your description, I guess that the Chrome client version you are using is not compatible with SameSite = None.
And Google begin to impose new cookie policies by default for users beginning with Chrome 80, which is slated to be released in early 2020.
In the new specification Google defines that in order to set a Cookie with
SameSite=None
, you also have to set theSecure
flag.For more details, please refer to the link below:
SameSite=None: Known Incompatible Clients
How To Correctly Delete Your SameSite Cookies In Chrome (80+)
[Http Foundation] Fix clear cookie samesite
Best regards,
Xudong Peng
Thursday, July 30, 2020 6:15 AM -
User-549756379 posted
Hi, My Google chrome version is
Version 84.0.4147.105
Thursday, July 30, 2020 6:26 AM -
User-939850651 posted
Hi O.Masnournia,
Could you provide the version of .NET Core?
As mentioned in the link I gave, there is another problem: ASP.NET Core authentication cookies are handled differently and managed by CookieManager. Unfortunately, because the old specification does not require security flags, the CookieManager code in .NET Core Framework(and .NET Full Framework) will not copy it into the actual Cookies.Delete() call at all.
This problem will be resolved in .NET Core 2.1 and .NET Core 3.x, but .NET Core 2.2 will not.
If you are using .NET Core 2.2, you probably should update to .NET Core 3.
Best regards,
Xudong Peng
Thursday, July 30, 2020 9:35 AM -
User-549756379 posted
Hi, I Use .Net 4.8
Thursday, July 30, 2020 2:33 PM -
User-939850651 posted
Hi O.Masnournia,
I created a simple example of this problem, created a cookie in Index, and deleted it in Welcome. In fact, it was successfully deleted.
But when I change the Secure property to false, it will not be able to delete cookies.public IActionResult Index() { var cookieOptions = new CookieOptions { Secure = true, HttpOnly = true, SameSite = SameSiteMode.None }; Response.Cookies.Append("test", "test value", cookieOptions); //var value = HttpContext.Request.Cookies["test"]; var cookieValue = Request.Cookies["test"]; ViewData["cookieValue"] = cookieValue; return View(); } public IActionResult Welcome() { Response.Cookies.Delete("test", new CookieOptions { Secure = true, HttpOnly = true, SameSite = SameSiteMode.None }); var cookieValue = Request.Cookies["test"]; ViewData["cookieValue"] = cookieValue; return View(); }
Index page: <h1>Index</h1> <h2>@ViewData["cookieValue"]</h2> <a href="/user/Welcome">to welcome page</a> Welcome page: <h1>Welcome</h1> Cookie: <b> @if (ViewData["cookieValue"] == null) { <label>Cookie has deleted</label> } else { <label>@ViewData["cookieValue"]</label> } </b>
So I think you need to double check whether the correct attribute value is set for it.
If possible, please provide more information, including relevant sample codes and related settings.
Best regards,
Xudong Peng
- Marked as answer by Anonymous Thursday, October 7, 2021 12:00 AM
Friday, July 31, 2020 10:18 AM -
User-549756379 posted
Yes,
var cookie = Request.Cookies["CookiName"];
cookie.Secure = true;
cookie.SameSite = SameSiteMode.None;
cookie.Expires = DateTime.Now.AddYears(-1);
cookie.Value = "";
HttpContext.Current.Response.Cookies.Add(cookie);- Marked as answer by Anonymous Thursday, October 7, 2021 12:00 AM
Friday, July 31, 2020 10:21 AM -
User1166908476 posted
Valeu pela resposta cada bem especificado me auxiliou e nós.
Friday, August 7, 2020 10:14 AM