Environment
- WebAPI (.NET Core v3)
- Angular (v8)
- Ngx-Cookie (v2.4)
- VS 2019 Integrated Project template (Angular + WebAPI combined)
Problem Statement
In our application, WebAPI calls the angular app and sets a cookie having auth tokens in the request. To comply with the present security, SameSite=strict, Secured=True is set, along with a timeout of 15min.
The angular app reads the cookie in ng-init event using ngx-cookie-service instance. The cookie service isn't able to read the cookie in FireFox (v74.a.b.c), but works fine in Chrome (v80.a.b.c) and Edge (v 18363).
We tried to place a debugger just before the cookie reading and checked the cookie's presence under Storage and it was present all right. Even manually when we execute the cookie service, it is unable to find.
However, when we come back to this route again, the cookie service is able to read the cookie successfully and perform further work properly. We thought that this may be due to execution time difference that read operation is done earlier than the write, so placed a setTimeout but it's still not working.
Code
WebAPI
CookieOptions cookieOptions = new CookieOptions()
{
Secure = true,
Expires = DateTime.Now.AddMinutes(tokenExpirationTimeout),
IsEssential = true,
SameSite = SameSiteMode.Strict
};
Angular
ngOnInit() {
setTimeout( () => {
var authToken = this.cookieService.get("AuthToken");
if (!authToken || authToken.length == 0) {
console.error("Authentication token not received");
this.router.navigate(["auth-failed"]);
}
this.StoreService.setUserName(
this.cookieService.get("userName")
);
this.router.navigate(["archive"]);
},
5000);
}
Note: for angular, the setTimeout call is added to delay to check read vs write difference, but doesn't helps. We always get empty cookie
If we redirect manually to this route again, the cookie is readily read.
Both angular and webapi are deployed in same app within Azure App Service, so no issues regarding CSRF/SameSite issues and also the HTTPS is taken care of.
(Update: Disabled Enhanced Security Protection as well as explicitly allowed cookie storage)

