The cookie '.AspNetCore.Identity.Application' has set 'SameSite=None' and must also set 'Secure'

user_10270135 0
Viewed 8339

I followed those links:

https://www.thinktecture.com/en/identity/samesite/prepare-your-identityserver/
https://www.thinktecture.com/en/identity/samesite/how-to-delete-samesite-cookies/

Those are my settings:

        services.AddIdentityServer()
         .AddApiAuthorization<ApplicationUser, ApplicationDbContext>();


        services.AddAuthentication()
            .AddIdentityServerJwt();

        services.ConfigureNonBreakingSameSiteCookies();

        // Adjust to this (or similar)
        services
           .AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
           .AddCookie(options =>
           {
               // add an instance of the patched manager to the options:
               options.CookieManager = new ChunkingCookieManager();
           });

And then in the configure:

        app.UseCookiePolicy();

I am trying to run identity over http. I get those errors when setting certain (but not all cookies), and I completely fail to delete the cookies in chrome

asp.net-core identity
2 Answers

In case anyone else comes across this and still has a problem. I ended up having to do a similar change for the NonceCookie and CorrelationCookie properties to get them to work. Our system is using Identity Server and lives behind a Load Balancer that also offloads the SSL piece.

services.AddAuthentication(options =>
{
   options.DefaultScheme = "cookies";
   options.DefaultChallengeScheme = "oidc";
})
.AddCookie("cookies", options =>
{
   options.Cookie.Name = "appcookie";
   options.Cookie.SameSite = SameSiteMode.Strict;
   options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
})
.AddOpenIdConnect("oidc", options =>
{
   options.NonceCookie.SecurePolicy = CookieSecurePolicy.Always;
   options.CorrelationCookie.SecurePolicy = CookieSecurePolicy.Always;
...
}
user_37688750

Everything is okay in your code, but you should more configure your cookies.

Add additional attributes - Secure, HttpOnly and SameSite in AddCookie. More information in official documentation

Example:

        services
           .AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
           .AddCookie(options =>
           {
               // add an instance of the patched manager to the options:
               options.CookieManager = new ChunkingCookieManager();

                options.Cookie.HttpOnly = true;
                options.Cookie.SameSite = SameSiteMode.None;
                options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
           });
user_35205070
Related