blocks|key|1499338|text|在对HttpCookie源进行深入审查之后，我们确认我们不能用代码来完成这个任务，因为没有办法在Cookie上添加额外的属性，而且类被标记为密封的。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1499339|但无论如何，我还是通过修改web.config来管理解决方案，如下所示。|blockquote|style|BOLD|1499340|<rewrite>
++<outboundRules>
++++<rule+name="Add+SameSite"+preCondition="No+SameSite">
++++++<match+serverVariable="RESPONSE_Set_Cookie"+pattern=".*"+negate="false"+/>
++++++<action+type="Rewrite"+value="{R:0};+SameSite=strict"+/>
++++++<conditions>
++++++</conditions>
++++</rule>
++++<preConditions>
++++++<preCondition+name="No+SameSite">
++++++++<add+input="{RESPONSE_Set_Cookie}"+pattern="."+/>
++++++++<add+input="{RESPONSE_Set_Cookie}"+pattern=";+SameSite=strict"+negate="true"+/>
++++++</preCondition>
++++</preConditions>
++</outboundRules>
</rewrite>|code-block|syntax|javascript|1499341|这将在每个集上添加SameSite=strict+-Cookie。|1499342|entityMap|0|LINK|mutability|MUTABLE|url|https://github.com/Microsoft/referencesource/blob/master/System.Web/HttpCookie.cs^0|2|B|0|0|D|A|0|0|5|R|0^^$0|@$1|2|3|4|5|6|7|X|8|@]|9|@$A|Y|B|Z|1|10]]|C|$]]|$1|D|3|E|5|F|7|11|8|@$A|12|B|13|G|H]]|9|@]|C|$]]|$1|I|3|J|5|K|7|14|8|@]|9|@]|C|$L|M]]|$1|N|3|O|5|6|7|15|8|@$A|16|B|17|G|H]]|9|@]|C|$]]|$1|P|3|-4|5|6|7|18|8|@]|9|@]|C|$]]]|Q|$R|$5|S|T|U|C|$V|W]]]]

After Deep review on <a href="https://github.com/Microsoft/referencesource/blob/master/System.Web/HttpCookie.cs" rel="noreferrer">HttpCookie Source</a> it's confirm that we cannot do this with the code, as there is no way to add extra attribute on Cookie and class is marked as sealed.

<blockquote>
 But still anyhow I manage solution by modifying web.config as below.
</blockquote>

<pre><code>&lt;rewrite&gt;
 &lt;outboundRules&gt;
 &lt;rule name="Add SameSite" preCondition="No SameSite"&gt;
 &lt;match serverVariable="RESPONSE_Set_Cookie" pattern=".*" negate="false" /&gt;
 &lt;action type="Rewrite" value="{R:0}; SameSite=strict" /&gt;
 &lt;conditions&gt;
 &lt;/conditions&gt;
 &lt;/rule&gt;
 &lt;preConditions&gt;
 &lt;preCondition name="No SameSite"&gt;
 &lt;add input="{RESPONSE_Set_Cookie}" pattern="." /&gt;
 &lt;add input="{RESPONSE_Set_Cookie}" pattern="; SameSite=strict" negate="true" /&gt;
 &lt;/preCondition&gt;
 &lt;/preConditions&gt;
 &lt;/outboundRules&gt;
&lt;/rewrite&gt;
</code></pre>

This add SameSite=strict on each Set-Cookie.

blocks|key|1499426|text|在创建cookie时，还可以在代码中设置此设置：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1499427|var+httpCookie+=+new+HttpCookie("mycookie",+"myvalue");
httpCookie.Path+%2B=+";SameSite=Strict";

Response.SetCookie(httpCookie);|code-block|syntax|javascript|1499428|这将给出以下标题：|1499429|Set-Cookie:mycookie=myvalue;+path=/;SameSite=Strict|1499430|在它被推入框架之前有点麻烦。|1499431|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|Q|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|R|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|S|8|@]|9|@]|A|$]]|$1|M|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|N|$]]

You can also set this in code when creating a cookie:

<pre><code>var httpCookie = new HttpCookie("mycookie", "myvalue");
httpCookie.Path += ";SameSite=Strict";

Response.SetCookie(httpCookie);
</code></pre>

This will give you the following header:

<pre><code>Set-Cookie:mycookie=myvalue; path=/;SameSite=Strict
</code></pre>

bit of a hack until it's pushed in to the framework.

blocks|key|2900318|text|.NET+4.7.2现在已经内置了对SameSite属性的支持。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|2900319|HttpCookie现在有一个名为SameSite的属性。|2900320|请参阅微软的更多信息这里。|2900321|不再需要通过配置文件对此进行黑客攻击。|2900322|entityMap|0|LINK|mutability|MUTABLE|url|https://msdn.microsoft.com/en-us/library/system.web.httpcookie.samesite(v=vs.110).aspx^0|I|8|0|0|A|H|8|0|A|2|0|0|0^^$0|@$1|2|3|4|5|6|7|T|8|@$9|U|A|V|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|W|8|@$9|X|A|Y|B|C]|$9|Z|A|10|B|C]]|D|@]|E|$]]|$1|H|3|I|5|6|7|11|8|@]|D|@$9|12|A|13|1|14]]|E|$]]|$1|J|3|K|5|6|7|15|8|@]|D|@]|E|$]]|$1|L|3|-4|5|6|7|16|8|@]|D|@]|E|$]]]|M|$N|$5|O|P|Q|E|$R|S]]]]

.NET 4.7.2 has now built-in support for <code>SameSite</code> property. The <code>HttpCookie</code> has now a property called <code>SameSite</code>. See more info <a href="https://msdn.microsoft.com/en-us/library/system.web.httpcookie.samesite(v=vs.110).aspx" rel="noreferrer">here</a> from Microsoft.

No need anymore to hack this through the config file.

blocks|key|2149829|text|前4.7.2只需将字符串附加到cookie路径即可。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2149830|FormsAuthentication.SetAuthCookie(username,+false,+FormsAuthentication.FormsCookiePath+%2B+";+SameSite=Lax");|code-block|syntax|javascript|2149831|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Pre 4.7.2 you can just append the string to the cookie path.

<pre><code>FormsAuthentication.SetAuthCookie(username, false, FormsAuthentication.FormsCookiePath + "; SameSite=Lax");
</code></pre>

blocks|key|2149871|text|只是添加我的答案，以系统化的所有信息，在这里和其他地方。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2149872|1.保护4.7.2及更高版本下的自定义cookie|2149873|var+c+=+new+HttpCookie("test");
c.SameSite+=+SameSiteMode.Lax;|code-block|syntax|javascript|2149874|2.保障表单认证cookie的安全|2149875|在web.config中|2149876|<authentication+mode="Forms">
++++<forms+.....+cookieSameSite="Lax"+/>
</authentication>|2149877|3.保护ASP.NET会话cookie|2149878|在Global.asax中|2149879|void+Session_Start(Object+sender,+EventArgs+e)
{
++++Response.Cookies["ASP.NET_SessionId"].SameSite+=+SameSiteMode.Lax;
++++//while+we're+at+it+lets+also+make+it+secure
++++if+(Request.IsSecureConnection)
++++++++Response.Cookies["ASP.NET_SessionId"].Secure+=+true;
}|2149880|有趣的事实:即使您设置了<httpCookies+requireSSL="true"+/>，由于某些原因，ASP.NET会话cookie仍然是不安全的。|offset|length|style|CODE|2149881|3(a)。更新01.2020:默认情况下，.NET+4.8会话cookie现在是"SameSite“|2149882|安装最新的Windows将使您的会话cookie默认为Lax。你可以在这里控制它：|2149883|<sessionState+cookieSameSite="Lax"+/>+|2149884|4.不存在<httpCookies+samesite=xxx>？|2149885|添加<httpCookies+sameSite="Strict"+/>+(如上面在web.config中的注释中所建议的)不起作用，我得到了错误。|2149886|未识别的属性“同温层”|blockquote|2149887|尽管我的目标是4.7.2。在多个项目和多台机器上进行测试，VS2019也没有在intellisense中显示这一点，MS文档也没有提到它。|2149888|entityMap^0|0|0|0|0|0|0|0|0|0|C|X|0|0|R|3|0|0|5|Q|0|2|X|0|0|0^^$0|@$1|2|3|4|5|6|7|1H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1I|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|1J|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|1K|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|1L|8|@]|9|@]|A|$]]|$1|M|3|N|5|F|7|1M|8|@]|9|@]|A|$G|H]]|$1|O|3|P|5|6|7|1N|8|@]|9|@]|A|$]]|$1|Q|3|R|5|6|7|1O|8|@]|9|@]|A|$]]|$1|S|3|T|5|F|7|1P|8|@]|9|@]|A|$G|H]]|$1|U|3|V|5|6|7|1Q|8|@$W|1R|X|1S|Y|Z]]|9|@]|A|$]]|$1|10|3|11|5|6|7|1T|8|@]|9|@]|A|$]]|$1|12|3|13|5|6|7|1U|8|@$W|1V|X|1W|Y|Z]]|9|@]|A|$]]|$1|14|3|15|5|F|7|1X|8|@]|9|@]|A|$G|H]]|$1|16|3|17|5|6|7|1Y|8|@$W|1Z|X|20|Y|Z]]|9|@]|A|$]]|$1|18|3|19|5|6|7|21|8|@$W|22|X|23|Y|Z]]|9|@]|A|$]]|$1|1A|3|1B|5|1C|7|24|8|@]|9|@]|A|$]]|$1|1D|3|1E|5|6|7|25|8|@]|9|@]|A|$]]|$1|1F|3|-4|5|6|7|26|8|@]|9|@]|A|$]]]|1G|$]]

Just adding my answer to systematize all the info found here and in other places.
<h2>1. To secure custom cookies under 4.7.2 and later</h2>
<pre><code>var c = new HttpCookie(&quot;test&quot;);
c.SameSite = SameSiteMode.Lax;
</code></pre>
<h2>2. To secure Forms authentication cookie</h2>
In web.config
<pre><code>&lt;authentication mode=&quot;Forms&quot;&gt;
 &lt;forms ..... cookieSameSite=&quot;Lax&quot; /&gt;
&lt;/authentication&gt;
</code></pre>
<h2>3. To secure ASP.NET Session cookie</h2>
In Global.asax
<pre><code>void Session_Start(Object sender, EventArgs e)
{
 Response.Cookies[&quot;ASP.NET_SessionId&quot;].SameSite = SameSiteMode.Lax;
 //while we're at it lets also make it secure
 if (Request.IsSecureConnection)
 Response.Cookies[&quot;ASP.NET_SessionId&quot;].Secure = true;
}
</code></pre>
Fun fact: even if you set <code>&lt;httpCookies requireSSL=&quot;true&quot; /&gt;</code> the ASP.NET session cookie will still be non-secure for some reason.
<h2>3(a). UPDATE 01.2020: .NET 4.8 Session cookie is now &quot;SameSite&quot; by default</h2>
Installing the latest Windows Update will make your session cookies <code>Lax</code> by default. You can control it here:
<pre><code>&lt;sessionState cookieSameSite=&quot;Lax&quot; /&gt; &lt;!-- in system.web --&gt;
</code></pre>
<h2>4. <code>&lt;httpCookies samesite=xxx&gt;</code> does not exist?</h2>
Adding <code>&lt;httpCookies sameSite=&quot;Strict&quot; /&gt;</code> like suggested in the comment above in web.config didn't work, I was getting the error.
<blockquote>
Unrecognized attribute 'samesite'
</blockquote>
Even though I'm targeting 4.7.2. Tested on multiple project and multiple machines, also VS2019 does not show this in intellisense and MS docs do not mention it anywhere.

blocks|key|1499615|text|为了将SameSite定义为ASP.NET_SessionId+cookie，我必须在system.web部分下设置web.config：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1499616|<sessionState+cookieSameSite="Lax"+/>|code-block|syntax|javascript|1499617|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

In order to have SameSite defined to ASP.NET_SessionId cookie I had to set the web.config under system.web section:

<pre><code>&lt;sessionState cookieSameSite="Lax" /&gt;
</code></pre>

blocks|key|2149900|text|https://www.nuget.org/packages/Microsoft.Owin.Security.Cookies/4.1.0现在支持SameSite。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2149901|这是一个非常好的消息，因为这里的其他解决方案并没有那么出色：|2149902|除了性能之外，实现OwinMiddleware：的工作得很好。这可能是特定于我们的环境，但该解决方案约占我们的CPU+10%25。|style|BOLD|CODE|2149903|<outboundRules>：可能有可能开始工作。但是到目前为止，我看到的所有解决方案，包括这个线程中的解决方案，在相同响应中设置多个cookie时，都会出现一些问题。|2149904|entityMap|0|LINK|mutability|MUTABLE|url|https://www.nuget.org/packages/Microsoft.Owin.Security.Cookies/4.1.0^0|0|1W|0|0|0|9|E|P|12|9|E|0|0|2D|0|F|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@$A|V|B|W|1|X]]|C|$]]|$1|D|3|E|5|6|7|Y|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|Z|8|@$A|10|B|11|H|I]|$A|12|B|13|H|I]|$A|14|B|15|H|J]]|9|@]|C|$]]|$1|K|3|L|5|6|7|16|8|@$A|17|B|18|H|I]|$A|19|B|1A|H|J]]|9|@]|C|$]]|$1|M|3|-4|5|6|7|1B|8|@]|9|@]|C|$]]]|N|$O|$5|P|Q|R|C|$S|T]]]]

<a href="https://www.nuget.org/packages/Microsoft.Owin.Security.Cookies/4.1.0" rel="nofollow noreferrer">https://www.nuget.org/packages/Microsoft.Owin.Security.Cookies/4.1.0</a> now supports SameSite.

That is very good news because the other solutions here doesn't work that brilliantly:

Implementing <code>OwinMiddleware</code>: Works great, except for performance. This might be something specific for our environment but that solution was about 10% of our CPU. 

<code>&lt;outboundRules&gt;</code>: Probably possible to get working. But all solutions I've seen so far and we tested, including the one in this thread, had some issues when multiple cookies where set in the same response.

I was surfing the web and found article <a href="https://www.sjoerdlangkemper.nl/2016/04/14/preventing-csrf-with-samesite-cookie-attribute/" rel="noreferrer">Preventing CSRF with the same-site cookie attribute</a>.

As on link maintain We need to add Set-Cookie header.

<blockquote>
 Set-Cookie: key=value; HttpOnly; SameSite=strict
</blockquote>

Now My Question is, I want to set this in my ASP.NET site in all Cookies and Authentication Cookie. 
I tried to set this using header from IIS but someone says this is wrong way implementation.

I have also tried below.

<pre><code>HttpCookie newAuthenticationCookie = new HttpCookie(FormsAuthentication.FormsCookieName
 , FormsAuthentication.Encrypt(newAuthenticationTicket))
 {
 HttpOnly = true
 };
newAuthenticationCookie.Values.Add("SameSite", "strict");
</code></pre>

But it seems like not helping me.

Please suggest me a better way to do this.

Thanks.

Preventing CSRF with the same-site cookie attribute

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我在网上冲浪，发现了一篇文章。作为链接维护，我们需要添加Set-Cookie标题。集-曲奇: key=value；HttpOnly；SameSite=strict现在我的问题是，我想把这个设置在我的ASP.NET网站上的所有饼干和认证饼干。我试图使用IIS的头来设置这个值，但是有人说这是错误的实现方式。我在下面也试过了...

问使用相同站点cookie属性防止CSRF。
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用相同站点cookie属性防止CSRF。EN