Windows 8 server , IIS 7.5 , .net version 4.6 , ASP.NET_SessionId cookies is not reflecting SameSite attribute

Question

as per recommendations I have written the rewrite rule to set the SameSite attribute for all cookies but that is not helping out. Surprisingly whether I have this rule added or not value for samesite attrigute is always blank. (I was expecting , None or Lax, or strict) . Does anybody know why any of my cookies is not getting value for samesite attribute? I am trying this on Chrome. screen shot from network tab , developer tool

Answer 1

There are two ways to set SameSite attribut.

First is set in Global.asax page.

 protected void Session_Start(object sender, EventArgs e)
    {
        Response.Cookies["ASP.NET_SessionId"].SameSite = SameSiteMode.None;
       //set samesite and secure should both exist, otherwise it will be blocked
        Response.Cookies["ASP.NET_SessionId"].Secure = true;
        Response.Cookies["ASP.NET_SessionId"].HttpOnly =false;
    }

Second is directly setting in web.config. Add <sessionState cookieSameSite="Strict" /> under <system.web>.

You also can use url rewrite to set, but I don't know your rule and cannot know what caused rewrite failed.

Note: clear cache and cookie in browser after each modification or use private mode of browser. Otherwise it still show the previous cookie.