huahaofeng
/
aspnetcore
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Changed CookieTempDataProvider's cookie SameSite to Lax 

[Fixes #7190] Can not retrieve cookie-based TempData after Google authentication with account selection in Google Chrome
This commit is contained in:
Kiran Challa 2018-01-11 16:37:46 -08:00
parent d342ebf8c8
commit 91fb3eb41e
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/Microsoft.AspNetCore.Mvc.ViewFeatures/CookieTempDataProviderOptions.cs
View File

@ -16,7 +16,9 @@ namespace Microsoft.AspNetCore.Mvc
{ {
Name = CookieTempDataProvider.CookieName, Name = CookieTempDataProvider.CookieName,
HttpOnly = true, HttpOnly = true,
SameSite = SameSiteMode.Strict,
// Check the comment on CookieBuilder below for more details
SameSite = SameSiteMode.Lax,
// This cookie has been marked as non-essential because a user could use the SessionStateTempDataProvider, // This cookie has been marked as non-essential because a user could use the SessionStateTempDataProvider,
// which is more common in production scenarios. Check the comment on CookieBuilder below // which is more common in production scenarios. Check the comment on CookieBuilder below
@ -36,7 +38,9 @@ namespace Microsoft.AspNetCore.Mvc
/// Determines the settings used to create the cookie in <see cref="CookieTempDataProvider"/>. /// Determines the settings used to create the cookie in <see cref="CookieTempDataProvider"/>.
/// </para> /// </para>
/// <para> /// <para>
/// <see cref="CookieBuilder.SameSite"/> defaults to <see cref="SameSiteMode.Strict"/>. /// <see cref="CookieBuilder.SameSite"/> defaults to <see cref="SameSiteMode.Lax"/>. Setting this to
/// <see cref="SameSiteMode.Strict"/> may cause browsers to not send back the cookie to the server in an
/// OAuth login flow.
/// <see cref="CookieBuilder.SecurePolicy"/> defaults to <see cref="CookieSecurePolicy.SameAsRequest" />. /// <see cref="CookieBuilder.SecurePolicy"/> defaults to <see cref="CookieSecurePolicy.SameAsRequest" />.
/// <see cref="CookieBuilder.HttpOnly"/> defaults to <c>true</c>. /// <see cref="CookieBuilder.HttpOnly"/> defaults to <c>true</c>.
/// <see cref="CookieBuilder.IsEssential"/> defaults to <c>false</c>, This property is only considered when a /// <see cref="CookieBuilder.IsEssential"/> defaults to <c>false</c>, This property is only considered when a