Cookie Auth Fails in Embedded App

I am creating an app using .NET Core 2.1

When the app loads in the iFrame, the auth cookie is never set or read. Auth works fine outside of the iFrame. What am I missing?

I am running ngrok using: ngrok http -subdomain=mydomain -host-header=localhost:62754 62754

Here is my AuthorizationHandler.HandleRequirementAsync method 👍

protected override Task HandleRequirementAsync(AuthorizationHandlerContext context,
      SubscribedRequirment requirement) {
      // Get the context       
      if (!(context.Resource is AuthorizationFilterContext redirectContext)) {
        context.Fail();
        return Task.CompletedTask;
      }
      var isAuthenticated = _signInManager.IsSignedIn(context.User); // <-- This is always false in embedded iFrame
      if (isAuthenticated) {
        var userId = context.User.FindFirst(ClaimTypes.NameIdentifier)?.Value; 
        //Get the shop's status from the CacheEngine.
        var status = _cacheEngine.GetShopStatus(userId);
        if (status.BillingIsConnected && status.ShopIsConnected) {
          context.Succeed(requirement);
          return Task.CompletedTask;
        }
        if (status.BillingIsConnected == false) {
          //User has connected their Shopify shop, but they haven't accepted a subscription charge.
          redirectContext.Result = new RedirectToActionResult("register", "charge", null);
          context.Succeed(requirement);
          return Task.CompletedTask;
        }
        //User has created an account, but they haven't connected their Shopify shop.
        redirectContext.Result = new RedirectToActionResult("register", "connect", null);
        context.Succeed(requirement);
        return Task.CompletedTask;
      }
      //User has created an account, but they haven't connected their Shopify shop.
      redirectContext.Result = new RedirectToActionResult("index", "home", null);
      context.Succeed(requirement);
      return Task.CompletedTask;
    }

In Start up

services.Configure<CookiePolicyOptions>(options =>
      {
        options.CheckConsentNeeded = context => false;
        options.MinimumSameSitePolicy = SameSiteMode.None;
      });

[elegault]

This post solved a major headache for me. THANK YOU!

[Matt-Kaminski]

Which version of .Net are you using?

I’ve had this problem with .NET Core 2.1. It turns out that there is a bug caused by SameSiteMode.None not sending any attribute. For me, this was the solution:

Does not work:

myCookie.Path = “/”; myCookie.SameSite = SameSiteMode.None;

Do work:

myCookie.Path = “/; SameSite=None”;

Source: https://stackoverflow.com/a/58817862/4590784