SameSite is a 2016 extension to HTTP cookies intended to mitigate cross site request forgery (CSRF). The original design as was a feature web sites would opt into by adding the new parameters, not setting the SameSite property, or setting it to value of Laxindicated the cookie should be sent on navigation within the same site, or through GET navigation to your site from other sites. A value of Strict limited the cookie to requests only from the same site. .NET 4.7.2 and ASP.NET Core 2.0 added support for the SameSite property. OIDC and other features which send POST requests from an external site to the site requesting a login use cookies for correlation and CSRF protection and needed to opt-out of SameSite by not setting the property.
Google is now updating the standard and implementing their proposed changes in Chrome in a method. The change adds a new SameSite value, “None”, and changes the default behavior to “Lax”. This breaks OIDC logins, and potentially other features your web site may rely on, these features will have to use cookies whose SameSite property is set to a value of “None”. However browsers which adhere to the original standard and are unaware of the new value have a different behavior to browsers which use the new standard as the SameSite standard states that if a browser sees a value for SameSite it does not understand it should treat that value as “Strict”. This means your .NET website will now have to add user agent sniffing to decide whether you send the new None value, or not send the attribute at all.
.NET will issue updates to change the behavior of its SameSite attribute behavior in .NET 4.7.2 and in .NET Core 2.1 and above to reflect Google’s introduction of a new value. The updates for the .NET Framework will be available on November 19th as an optional update via Microsoft Update and WSUS if you use the “Check for Update” functionality. On December 10th it will become widely available and appear in Microsoft Update without you having to specifically check for updates. .NET Core updates will be available with .NET Core 3.1 starting with preview 1, in November.
.NET Core 3.1 will contain an updated enum definition, SameSite.Unspecified which will not set the SameSite property.
The OIDC middleware for Katana v4 and .NET Core will be updated at the same time as their .NET Framework and .NET updates however we cannot introduce the user agent sniffing code into the framework, this must be implemented in your site code. The implementation of agent sniffing will vary according to what version of ASP.NET or ASP.NET Core you are using and the browsers you wish to support.
For ASP.NET 4.72 Katana agent sniffing should be implemented in an implementation of ICookieManager;
public class SameSiteCookieManager : ICookieManager
{
private readonly ICookieManager _innerManager;
public SameSiteCookieManager() : this(new CookieManager())
{
}
public SameSiteCookieManager(ICookieManager innerManager)
{
_innerManager = innerManager;
}
public void AppendResponseCookie(IOwinContext context, string key, string value,
CookieOptions options)
{
CheckSameSite(context, options);
_innerManager.AppendResponseCookie(context, key, value, options);
}
public void DeleteCookie(IOwinContext context, string key, CookieOptions options)
{
CheckSameSite(context, options);
_innerManager.DeleteCookie(context, key, options);
}
public string GetRequestCookie(IOwinContext context, string key)
{
return _innerManager.GetRequestCookie(context, key);
}
private void CheckSameSite(IOwinContext context, CookieOptions options)
{
if (DisallowsSameSiteNone(context) && options.SameSite == SameSiteMode.None)
{
options.SameSite = null;
}
}
public static bool DisallowsSameSiteNone(IOwinContext context)
{
// TODO: Use your User Agent library of choice here.
var userAgent = context.Request.Headers["User-Agent"];
return userAgent.Contains("BrokenUserAgent") ||
userAgent.Contains("BrokenUserAgent2")
}
}
And then configure OIDC settings to use the new CookieManager;
app.UseOpenIdConnectAuthentication(
new OpenIdConnectAuthenticationOptions
{
// … Your preexisting options …
CookieManager = new SameSiteCookieManager(new SystemWebCookieManager())
});
For ASP.NET Core you should implement the sniffing code within a cookie policy
private void CheckSameSite(HttpContext httpContext, CookieOptions options)
{
if (options.SameSite > SameSiteMode.Unspecified)
{
var userAgent = httpContext.Request.Headers["User-Agent"].ToString();
// TODO: Use your User Agent library of choice here.
if (/* UserAgent doesn’t support new behavior /*)
{
// For .NET Core < 3.1 set SameSite = -1
options.SameSite = SameSiteMode.Unspecified;
}
}
}
public void ConfigureServices(IServiceCollection services)
{
services.Configure<CookiePolicyOptions>(options =>
{
options.MinimumSameSitePolicy = SameSiteMode.Unspecified;
options.OnAppendCookie = cookieContext =>
CheckSameSite(cookieContext.Context, cookieContext.CookieOptions);
options.OnDeleteCookie = cookieContext =>
CheckSameSite(cookieContext.Context, cookieContext.CookieOptions);
});
}
public void Configure(IApplicationBuilder app)
{
app.UseCookiePolicy(); // Before UseAuthentication or anything else that writes cookies.
app.UseAuthentication();
// …
}
Under testing with the Azure Active Directory team we have found the following checks work for all the common user agents that Azure Active Directory sees that don’t understand the new value.
public static bool DisallowsSameSiteNone(string userAgent)
{
// Cover all iOS based browsers here. This includes:
// - Safari on iOS 12 for iPhone, iPod Touch, iPad
// - WkWebview on iOS 12 for iPhone, iPod Touch, iPad
// - Chrome on iOS 12 for iPhone, iPod Touch, iPad
// All of which are broken by SameSite=None, because they use the iOS networking stack
if (userAgent.Contains("CPU iPhone OS 12") || userAgent.Contains("iPad; CPU OS 12"))
{
return true;
}
// Cover Mac OS X based browsers that use the Mac OS networking stack. This includes:
// - Safari on Mac OS X.
// This does not include:
// - Chrome on Mac OS X
// Because they do not use the Mac OS networking stack.
if (userAgent.Contains("Macintosh; Intel Mac OS X 10_14") &&
userAgent.Contains("Version/") && userAgent.Contains("Safari"))
{
return true;
}
// Cover Chrome 50-69, because some versions are broken by SameSite=None,
// and none in this range require it.
// Note: this covers some pre-Chromium Edge versions,
// but pre-Chromium Edge does not require SameSite=None.
if (userAgent.Contains("Chrome/5") || userAgent.Contains("Chrome/6"))
{
return true;
}
return false;
}
This browser list is by no means canonical and you should validate that the common browsers and other user agents your system supports behave as expected once the update is in place.
Chrome is scheduled to turn on the new behavior in February or March 2020, with a temporary mitigation in Chrome 79 Beta. If you want to test against known breaking browsers older versions of Chromium are available for download, Chromium 76 and Chromium 74 both will exhibit the incompatible behavior with the new standard.
If you cannot update your framework versions by the time Chrome turns the new behavior in early 2020 you may be able to change your ODIC flow to a Code flow, rather than the default implicit flow that ASP.NET and ASP.NET Core uses, but this should be viewed as a temporary measure.
- For ASP.NET MVC and Katana support you can use the Katana GitHub repository at https://github.com/aspnet/AspNetKatana.
- For ASP.NET Core support you can use the ASP.NET GitHub repository at https://github.com/aspnet/AspNetCore.
- For .NET Framework support please see https://dotnet.microsoft.com/platform/support/policy/dotnet-framework
We strongly encourage you to download the updated .NET Framework and .NET Core versions and start planning your update now, before Chrome’s changes are rolled out.
The post Upcoming SameSite Cookie Changes in ASP.NET and ASP.NET Core appeared first on ASP.NET Blog.