SameSite cookie management

Has anyone looked at supporting the new stricter samesite cookie standard? Chrome has started enforcing the behavior, so I see following exception after /login: A cookie associated with a resource at http://localhost/ was set with SameSite=Nonebut withoutSecure. It has been blocked, as Chrome now only delivers cookies marked SameSite=Noneif they are also markedSecure. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5633521622188032.

After reviewing https://www.thinktecture.com/en/identity/samesite/prepare-your-identityserver/ I was able to modify the server to return SameSite=Lax without much effort, but it’s a simplistic approach. I assume a better implementation would be to allow the policy to be configurable.

[AleF83]

I mean to add function to Config.cs that will parse json from file/env (like all other configurations) and then to merge the parsed object into the options argument of the AddCookie function.

[AleF83]

So summarizing the issue. There are two ways to solve it.

1. Leave cookie SameSite mode to default (None) and make calls the server via HTTPS protocol.
2. Change cookie SameSite mode to Lax and use HTTP protocol. It can be done by setting the following in SERVER_OPTIONS_PATH env var

{
  "Authentication": {
    "CookieSameSiteMode": "Lax",
    "CheckSessionCookieSameSiteMode": "Lax"
  }
}