CODEWITHSUNDEEP
asp.net-corecookiesidentityserver4samesite
Ruben Aleksanyan
Ruben Aleksanyan

Reputation: 103

Set cookie not over HTTPS in ASP.NET Core

I have two microservices. One is for identity. I am trying to set auth cookie and I have this middleware:

app.UseCookiePolicy(new CookiePolicyOptions
{
    MinimumSameSitePolicy = SameSiteMode.None,
    Secure = CookieSecurePolicy.None,
    HttpOnly = Microsoft.AspNetCore.CookiePolicy.HttpOnlyPolicy.None
});

And also this service:

services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options =>
    {
        options.Cookie.HttpOnly = true;
        options.Cookie.SameSite = SameSiteMode.None;
        options.Cookie.SecurePolicy = CookieSecurePolicy.None;
        options.Cookie.IsEssential = true;
    });

And also browser throws this warning:

enter image description here

So I want to know if it is possible to set cookie not over HTTPS.

Upvotes: 1

Views: 2345

Answers (1)

Tore Nestenius
Tore Nestenius

Reputation: 19971

You need to set the cookie over Https, otherwise it will not work.

This is because the Samesite cookie functionality requires that it is done over HTTPs when the cookies reaches the browser.

see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite

That says:

Cookies with SameSite=None must now also specify the Secure attribute (they require a secure context/HTTPS).

To complement this answer, I wrote a blog post that goes into more detail about this topic: Debugging cookie problems

Upvotes: 3

Related Questions