SameSite Cookie Changes Issue

I have a Single page web application with consists of the following

1. Angular 8 Front End
2. .Net Core Web Api Back End
3. .Net Core Identity Server Authentication Server (Skoruba Admin .NET Core 2.2)

I recently started to see a few warnings in my console which reads - "A cookie associated with a cross-site resource at “” was set without the ‘SameSite’ attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with ‘SameSite=None’ and ‘Secure’.

So based upon this a did a little bit of research and landed on the following article, which happens to explain everything that is going on in detail. Explanation of Cookie Issue

I read the article over several times and think I have a grasp of it, but still I am struggling on one simple aspect of it. There is a few areas where they ask you to add some code to your “Project”. My question is (being still somewhat of a newbie with Identity Server and its inner workings), is what is the “Project” they are referring to. I am not exactly sure where to put the code they provide in order to fix the issue.

1. For me its not so obvious on where exactly to put the provided code. I have 2 Visual Studio solutions - one representing my authentication server (Identity Server Skoruba) and one for my Web Api. Which of these solutions’ Startup.cs files do I add the code solution?

2. I am assuming that I have to add the following code somewhere in my STS project

services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
            .AddCookie("Cookies", options =>
            {
                options.Cookie.SameSite = SameSiteMode.None;
            });

I am just not exactly sure where to add that. I read a few articles which said that Identity Server, by default, creates a cookie for you automatically after successfully logging in and that I don’t need to add anything custom. What I am thinking is that I may have to update that default cookie to be SameSite=None, just not exactly sure how to go about doing that. I am afraid that the above code will override any authentication I have. The only line related to adding authentication in the STS project I see is located in the “ConfigureServices” method: services.AddAuthenticationServices<AdminIdentityDbContext, UserIdentity, UserIdentityRole>(HostingEnvironment, rootConfiguration.AdminConfiguration);

1. One more thing I did notice is that once the cookies are set they are not being deleted when a logout is performed.

Keep in mind that these issues are only occuring on a MacOS running Google Chrome. If I run my application on a Windows PC, I still see the warnings, but I am able to log out and clear all existing cookies

[jberg2016]

OS : Windows Parallels Browser : Chrome Version 80.0.3987.132 with Chrome feature flag SameSite set as “default”

I am running your latest release and applied your fixes.

Steps:

1. I start up Visual Studio Debug IISExpress running both the Admin and STS Identity projects on their respective ports http://localhost:5000 and http://localhost:9000

2. The Admin application then correctly redirects to the login of the STS Identity app for authentication

3. I enter the correct admin credentials and then I am instantly redirected back to the login page instead of the Admin application.

4. Now if I change the chrome feature flag SameSite setting to “disabled”, after relaunching and logging in again as the Admin, I am correctly redirected back to the Admin application and I am logged in.

5. I was then able to view the state of the cookies from the dev tools. I am also seeing the same warning messages as @bryan in my console.

Is this information helpful? If there is anything other information you would like, let me know.

Thanks again

[skoruba]

Fixed in master branch.