Change SameSite default to None

[Tratcher]

#2675 #4661 Note this changes the basic infrastructure defaults but does not change any given component's behavior as each component already specified their SameSite config.

SameSite defaults:

• Session: Lax
• CookieTempDataProvider: Lax
• Antiforgery: Strict
• CookieAuth: Lax
• Twitter state cookie: Lax
• Remote auth corrilation cookie (OAuth): None
• OIDC nonce cookie: None

[WIP] Running tests to make sure I didn't miss any.

[blowdart]

If this doesn't affect any of our components anyway, then why do the change from "most secure" at all? We'd still be broken.

[Tratcher]

The point here is that SameSite has been breaking arbitrary components that aren't aware of it so we're changing to an opt-in model. Our components have already opted in as far as they're able.

[blowdart]

Opt-in to security is generally not the route we take though

[HaoK]

Looks fine code wise, I defer to @blowdart if this is something that's safe or good to do

[Tratcher]

If it was a stable security feature I'd agree, but it's not, Apple keeps breaking it.

[blowdart]

So now I ask the impossible, if it's affecting other components can I get an idea of how widespread this is?

[Tratcher]

We have three datapoints:

1. The CookiePolicy SameSite default broke all remote auth and had to be disabled in the templates. People still regularly break this if they don't have that line.
2. Anyone calling Response.Cookies.Append also defaulted to Lax. There haven't been as many direct reports of this issue.
3. Anyone using Lax on IOS is broken and they've had to disable it everywhere. We've gotten a lot of hits on this one and it's not just auth cookies, it affects session, app cookies (See 2), etc..

This change fixes the first two. It doesn't fix the 3rd.

[blowdart]

OK fair, I submit :)

[blowdart]

Looks meh to me, but what can I do? :D

[analogrelay]

@Tratcher please rebase on master ASAP. This is failing due to a flaky test that has been skipped in master

[analogrelay]

/azp run AspNetCore-helix-test

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).