how to protect Google Chrome 80 beta asp + iframe

user_13003621 0
Viewed 1356

The web service environment is operated by Windows 2012 server, IIS8.5, Classic asp.

this is problem about Chrome 80ver SameSite Issue.

On our site, we make payments by calling iframes and receive the results by returnurl. However, there is a problem in returnurl that changes the existing session value (sometimes it is maintained and sometimes it is changed).

I tried to First. Add header in source code as follows

Response.AddHeader "Set-Cookie", "SameSite=None; Secur; path=/; HttpOnly"

Second. Add web.config 

<system.web>
<httpCookies httpOnlyCookies="true" requireSSL="true" sameSite="None" />
<sessionState cookieSameSite="None" />

Third. Add web.config rewrite

<rewrite>
 <outboundRules>
    <rule name="AddSameSiteCookieFlag">
       <match serverVariable="RESPONSE_Set-Cookie" pattern="^(.*SessionID)(SameSite=Lax)" />
       <action type="Rewrite" value="{R:1};SameSite=None" />
    </rule>
</outboundRules>

Is there a way to set the samesite setting to none in IIS8.5?

iis-8.5 samesite asp-classic iis
1 Answers

I'm running the exact configuration mentioned in this question and found the following web.config rewrite rules to work as a baseline solution:

<rewrite>
    <outboundRules>
        <rule name="Add HttpOnly" preCondition="No HttpOnly">
            <match serverVariable="RESPONSE_Set_Cookie" pattern=".*" negate="false" />
            <action type="Rewrite" value="{R:0}; HttpOnly" />
            <conditions>
        </conditions>
        </rule>
        <rule name="Add SameSite" preCondition="No SameSite">
            <match serverVariable="RESPONSE_Set_Cookie" pattern=".*" negate="false" />
            <action type="Rewrite" value="{R:0}; SameSite=None; Secure" />
        </rule>
        <preConditions>
            <preCondition name="No HttpOnly">
                <add input="{RESPONSE_Set_Cookie}" pattern="." />
                <add input="{RESPONSE_Set_Cookie}" pattern="; HttpOnly" negate="true" />
            </preCondition>
            <preCondition name="No SameSite">
                <add input="{RESPONSE_Set_Cookie}" pattern="." />
                <add input="{RESPONSE_Set_Cookie}" pattern="; SameSite=None; Secure" negate="true" />
            </preCondition>
        </preConditions>
    </outboundRules>
</rewrite>
user_130570230
Related