Some Cookie SameSite defaults changed to None

[Tratcher]

Some Cookie SameSite defaults changed to None

SameSite is an option for cookies that can help mitigate some CSRF attacks. When this option was initially introduced inconsistent defaults were used across various AspNetCore APIs that has lead to confusing results. In 3.0.0-preview4 we've better aligned these defaults and made the feature opt-in on a per-component basis.

Version introduced

3.0

Old behavior

APIs defaulted to SameSiteMode.Lax.

New behavior

APIs default to SameSiteMode.None.

Reason for change

To make SameSite an opt-in feature.

Recommended action

Each component that emits cookies need to decide if SameSite is appropriate for their scenarios. Review your usage of the affected APIs and reconfigure SameSite as needed.

Category

ASP.NET

Affected APIs

• CookieOptions used with HttpResponse.Cookies.Append has changed its default from SameSiteMode.Lax to SameSiteMode.None.
• CookieBuilder.SameSite used as a factory for CookieOptions has changed its default from SameSiteMode.Lax to SameSiteMode.None.
• CookiePolicyOptions.MinimumSameSitePolicy has changed its default from SameSiteMode.Lax to SameSiteMode.None.

---

Issue metadata

• Issue type: breaking-change