Why won't cross site cookies be sent even with https, samesite=none, and secure=true

Question

I'm creating a proof of concept to use cookie authentication with jwt's in aspnet core with a separate UI server (i.e. the UI is hosted on localhost:4200 and the backend on localhost:5001). This repo that exhibits this and the following problem can be found here. It based off of dotnet-labs/JwtAuthDemo. No matter how hard I try, I cannot seem to get the cookie to be set in the browser tab for the UI page despite the set-cookie header being clearly seen in the response header on login. I can only get the cookie to be set when I use the swagger page for the backend (which uses same site conventions).

Note: the original repo that this is based off of uses jwt's and session storage so the app works just fine. I'm trying to get the jwt set in a cross site cookie as a proof of concept with the following line HttpContext.Response.Cookies.Append("TestCookie", jwtResult.AccessToken, cookieOptions);

The flow is as follows:

I make a login request here

this.http.post(`${this.apiUrl}/login`, { username, password })

It is then intercepted here where I try to add withCredentials or any headers

request = request.clone({
    withCredentials: true
});

It is then received by the backend with the following CORS setup

services.AddCors(options =>
{
    options.AddDefaultPolicy(
        builder =>
        {
            builder
                .WithOrigins("http://localhost:4200", "https://www.local.dev")
                .AllowCredentials()
                .WithHeaders("Content-Type")
                .AllowAnyMethod();
        }
    );
});

It is then received by the following controller method where I try to set the cookie on this line

// Ommitting cookie options for brevity
HttpContext.Response.Cookies.Append("TestCookie", jwtResult.AccessToken);

// The source code doesn't have it, but I tried using various cookie options like the following
HttpContext.Response.Cookies.Append("TestCookie", jwtResult.AccessToken, new CookieOptions
{
    SameSite = SameSiteMode.None
    Secure = true
});
// and also the following among other configurations
HttpContext.Response.Cookies.Append("TestCookie", jwtResult.AccessToken, new CookieOptions
{
    SameSite = SameSiteMode.Lax
});

The response is then received by the browser exactly like the responses posted in this stack overflow question. Secifically, this is what I receive in my browser: The request comes back with the cookie as expected: But, alas, no cookie is set: This happens even samesite=none and secure=true: When I login via the swagger page (which is same site), I get the following response: And I see the cookie is set: It also works when samesite=none and secure=true

I have tried all of the common things to solve this problem that the internet, especially the stack overflow community, recommends:

make sure CORS is set properly
- I have all the proper headers set
make sure samesite=lax is set or samesite=none with secure=true and https
- Neither works for this project either
- I have even gone as far to set up a reverse proxy on my local machine to get https on both the front end and back end (didn't work either)
realize that chrome silently blocks any cross site cookies that don't have samesite=none, secure=true, and are sent over https
- I have even tried this on firefox and I can't get it working
make sure withCredentials=true or credentials='include' on the request being sent
- I think this is just for sending cookies, not setting them, but it still doesn't work

Other solutions tried and resources consulted:

- https://stackoverflow.com/questions/46288437/set-cookies-for-cross-origin-requests
    - I am actually experiencing this exact same problem with the same symptoms, but none of the solutions are working

- https://medium.com/swlh/7-keys-to-the-mystery-of-a-missing-cookie-fdf22b012f09
- https://github.com/axios/axios/issues/1553
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie
- https://stackoverflow.com/questions/50511096/set-cookie-not-working-in-chrome
- https://stackoverflow.com/questions/50369779/cookie-not-being-set-in-browser
- https://stackoverflow.com/questions/60131986/why-chrome-can-t-set-cookie
- https://stackoverflow.com/questions/6970754/why-are-my-cookies-not-setting
- https://github.com/github/fetch/issues/386
- https://stackoverflow.com/questions/1134290/cookies-on-localhost-with-explicit-domain/1188145#1188145
- https://docs.microsoft.com/en-us/aspnet/core/security/cors?view=aspnetcore-5.0#credentials-in-cross-origin-requests
- https://stackoverflow.com/questions/7346919/chrome-localhost-cookie-not-being-set
- https://stackoverflow.com/questions/49065174/why-does-chrome-ignore-set-cookie-header
- https://medium.com/swlh/how-the-new-chrome-80-cookie-rule-samesite-none-secure-affects-web-development-c06380220ced

Given that all of the solutions point to the same solution and its not working for me, I must have set something up incorrectly or must be missing something really obvious. Perhaps there is a silent browser feature I'm not aware of? What is the issue here?

Why won't cross site cookies be sent even with https, samesite=none, and secure=true

0 Answers