Skip to content

Commit 93b195e

Browse files
TratcherTratcher
authored
Change SameSite default to None #2675 #4661 (#8043)
1 parent 01ce283 commit 93b195e

File tree

9 files changed

+69
-76
lines changed

9 files changed

+69
-76
lines changed

‎src/Http/Http.Abstractions/src/CookieBuilder.cs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright (c) .NET Foundation. All rights reserved.
1+
// Copyright (c) .NET Foundation. All rights reserved.
22
// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
33

44
using System;
@@ -49,12 +49,12 @@ public virtual string Name
4949
public virtual bool HttpOnly { get; set; }
5050

5151
/// <summary>
52-
/// The SameSite attribute of the cookie. The default value is <see cref="SameSiteMode.Lax"/>
52+
/// The SameSite attribute of the cookie. The default value is <see cref="SameSiteMode.None"/>
5353
/// </summary>
5454
/// <remarks>
5555
/// Determines the value that will set on <seealso cref="CookieOptions.SameSite"/>.
5656
/// </remarks>
57-
public virtual SameSiteMode SameSite { get; set; } = SameSiteMode.Lax;
57+
public virtual SameSiteMode SameSite { get; set; } = SameSiteMode.None;
5858

5959
/// <summary>
6060
/// The policy that will be used to determine <seealso cref="CookieOptions.Secure"/>.

‎src/Http/Http.Features/src/CookieOptions.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,10 +43,10 @@ public CookieOptions()
4343
public bool Secure { get; set; }
4444

4545
/// <summary>
46-
/// Gets or sets the value for the SameSite attribute of the cookie. The default value is <see cref="SameSiteMode.Lax"/>
46+
/// Gets or sets the value for the SameSite attribute of the cookie. The default value is <see cref="SameSiteMode.None"/>
4747
/// </summary>
4848
/// <returns>The <see cref="SameSiteMode"/> representing the enforcement mode of the cookie.</returns>
49-
public SameSiteMode SameSite { get; set; } = SameSiteMode.Lax;
49+
public SameSiteMode SameSite { get; set; } = SameSiteMode.None;
5050

5151
/// <summary>
5252
/// Gets or sets a value that indicates whether a cookie is accessible by client-side script.

‎src/Middleware/Rewrite/test/UrlActions/ChangeCookieActionTests.cs

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ public void SetsCookie()
3030

3131
var cookieHeaders = context.HttpContext.Response.Headers[HeaderNames.SetCookie];
3232
var header = Assert.Single(cookieHeaders);
33-
Assert.Equal($"Cookie=Chocolate%20Chip; expires={HeaderUtilities.FormatDate(now.AddMinutes(1440))}; domain=contoso.com; path=/recipes; secure; samesite=lax; httponly", header);
33+
Assert.Equal($"Cookie=Chocolate%20Chip; expires={HeaderUtilities.FormatDate(now.AddMinutes(1440))}; domain=contoso.com; path=/recipes; secure; httponly", header);
3434
}
3535

3636
[Fact]
@@ -46,7 +46,7 @@ public void ZeroLifetime()
4646

4747
var cookieHeaders = context.HttpContext.Response.Headers[HeaderNames.SetCookie];
4848
var header = Assert.Single(cookieHeaders);
49-
Assert.Equal($"Cookie=Chocolate%20Chip; samesite=lax", header);
49+
Assert.Equal($"Cookie=Chocolate%20Chip", header);
5050
}
5151

5252

@@ -60,7 +60,7 @@ public void UnsetCookie()
6060

6161
var cookieHeaders = context.HttpContext.Response.Headers[HeaderNames.SetCookie];
6262
var header = Assert.Single(cookieHeaders);
63-
Assert.Equal($"Cookie=; samesite=lax", header);
63+
Assert.Equal($"Cookie=", header);
6464
}
6565
}
6666
}

‎src/ProjectTemplates/Web.ProjectTemplates/content/RazorPagesWeb-CSharp/Startup.cs

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,6 @@ public void ConfigureServices(IServiceCollection services)
5858
{
5959
// This lambda determines whether user consent for non-essential cookies is needed for a given request.
6060
options.CheckConsentNeeded = context => true;
61-
options.MinimumSameSitePolicy = SameSiteMode.None;
6261
});
6362

6463
#if (IndividualLocalAuth)

‎src/ProjectTemplates/Web.ProjectTemplates/content/StarterWeb-CSharp/Startup.cs

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,6 @@ public void ConfigureServices(IServiceCollection services)
5858
{
5959
// This lambda determines whether user consent for non-essential cookies is needed for a given request.
6060
options.CheckConsentNeeded = context => true;
61-
options.MinimumSameSitePolicy = SameSiteMode.None;
6261
});
6362

6463
#if (IndividualLocalAuth)

‎src/Security/CookiePolicy/src/CookiePolicyOptions.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ public class CookiePolicyOptions
1515
/// <summary>
1616
/// Affects the cookie's same site attribute.
1717
/// </summary>
18-
public SameSiteMode MinimumSameSitePolicy { get; set; } = SameSiteMode.Lax;
18+
public SameSiteMode MinimumSameSitePolicy { get; set; } = SameSiteMode.None;
1919

2020
/// <summary>
2121
/// Affects whether cookies must be HttpOnly.
@@ -49,4 +49,4 @@ public class CookiePolicyOptions
4949
/// </summary>
5050
public Action<DeleteCookieContext> OnDeleteCookie { get; set; }
5151
}
52-
}
52+
}

‎src/Security/CookiePolicy/test/CookieChunkingTests.cs

Lines changed: 14 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ public void AppendLargeCookie_Appended()
1818
new ChunkingCookieManager() { ChunkSize = null }.AppendResponseCookie(context, "TestCookie", testString, new CookieOptions());
1919
var values = context.Response.Headers["Set-Cookie"];
2020
Assert.Single(values);
21-
Assert.Equal("TestCookie=" + testString + "; path=/; samesite=lax", values[0]);
21+
Assert.Equal("TestCookie=" + testString + "; path=/", values[0]);
2222
}
2323

2424
[Fact]
@@ -29,18 +29,13 @@ public void AppendLargeCookieWithLimit_Chunked()
2929
string testString = "abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ";
3030
new ChunkingCookieManager() { ChunkSize = 44 }.AppendResponseCookie(context, "TestCookie", testString, new CookieOptions());
3131
var values = context.Response.Headers["Set-Cookie"];
32-
Assert.Equal(9, values.Count);
32+
Assert.Equal(4, values.Count);
3333
Assert.Equal<string[]>(new[]
3434
{
35-
"TestCookie=chunks-8; path=/; samesite=lax",
36-
"TestCookieC1=abcdefgh; path=/; samesite=lax",
37-
"TestCookieC2=ijklmnop; path=/; samesite=lax",
38-
"TestCookieC3=qrstuvwx; path=/; samesite=lax",
39-
"TestCookieC4=yz012345; path=/; samesite=lax",
40-
"TestCookieC5=6789ABCD; path=/; samesite=lax",
41-
"TestCookieC6=EFGHIJKL; path=/; samesite=lax",
42-
"TestCookieC7=MNOPQRST; path=/; samesite=lax",
43-
"TestCookieC8=UVWXYZ; path=/; samesite=lax",
35+
"TestCookie=chunks-3; path=/",
36+
"TestCookieC1=abcdefghijklmnopqrstuv; path=/",
37+
"TestCookieC2=wxyz0123456789ABCDEFGH; path=/",
38+
"TestCookieC3=IJKLMNOPQRSTUVWXYZ; path=/",
4439
}, values);
4540
}
4641

@@ -117,14 +112,14 @@ public void DeleteChunkedCookieWithOptions_AllDeleted()
117112
Assert.Equal(8, cookies.Count);
118113
Assert.Equal(new[]
119114
{
120-
"TestCookie=; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=foo.com; path=/; samesite=lax",
121-
"TestCookieC1=; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=foo.com; path=/; samesite=lax",
122-
"TestCookieC2=; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=foo.com; path=/; samesite=lax",
123-
"TestCookieC3=; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=foo.com; path=/; samesite=lax",
124-
"TestCookieC4=; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=foo.com; path=/; samesite=lax",
125-
"TestCookieC5=; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=foo.com; path=/; samesite=lax",
126-
"TestCookieC6=; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=foo.com; path=/; samesite=lax",
127-
"TestCookieC7=; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=foo.com; path=/; samesite=lax",
115+
"TestCookie=; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=foo.com; path=/",
116+
"TestCookieC1=; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=foo.com; path=/",
117+
"TestCookieC2=; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=foo.com; path=/",
118+
"TestCookieC3=; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=foo.com; path=/",
119+
"TestCookieC4=; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=foo.com; path=/",
120+
"TestCookieC5=; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=foo.com; path=/",
121+
"TestCookieC6=; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=foo.com; path=/",
122+
"TestCookieC7=; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=foo.com; path=/",
128123
}, cookies);
129124
}
130125
}

‎src/Security/CookiePolicy/test/CookieConsentTests.cs

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ public async Task ConsentChecksOffByDefault()
2929
context.Response.Cookies.Append("Test", "Value");
3030
return Task.CompletedTask;
3131
});
32-
Assert.Equal("Test=Value; path=/; samesite=lax", httpContext.Response.Headers[HeaderNames.SetCookie]);
32+
Assert.Equal("Test=Value; path=/", httpContext.Response.Headers[HeaderNames.SetCookie]);
3333
}
3434

3535
[Fact]
@@ -93,7 +93,7 @@ public async Task NonEssentialCookiesCanBeAllowedViaOnAppendCookie()
9393
context.Response.Cookies.Append("Test", "Value", new CookieOptions() { IsEssential = false });
9494
return Task.CompletedTask;
9595
});
96-
Assert.Equal("Test=Value; path=/; samesite=lax", httpContext.Response.Headers[HeaderNames.SetCookie]);
96+
Assert.Equal("Test=Value; path=/", httpContext.Response.Headers[HeaderNames.SetCookie]);
9797
}
9898

9999
[Fact]
@@ -112,7 +112,7 @@ public async Task NeedsConsentDoesNotPreventEssentialCookies()
112112
context.Response.Cookies.Append("Test", "Value", new CookieOptions() { IsEssential = true });
113113
return Task.CompletedTask;
114114
});
115-
Assert.Equal("Test=Value; path=/; samesite=lax", httpContext.Response.Headers[HeaderNames.SetCookie]);
115+
Assert.Equal("Test=Value; path=/", httpContext.Response.Headers[HeaderNames.SetCookie]);
116116
}
117117

118118
[Fact]
@@ -165,7 +165,7 @@ public async Task HasConsentReadsRequestCookie()
165165
context.Response.Cookies.Append("Test", "Value");
166166
return Task.CompletedTask;
167167
});
168-
Assert.Equal("Test=Value; path=/; samesite=lax", httpContext.Response.Headers[HeaderNames.SetCookie]);
168+
Assert.Equal("Test=Value; path=/", httpContext.Response.Headers[HeaderNames.SetCookie]);
169169
}
170170

171171
[Fact]
@@ -223,12 +223,12 @@ public async Task GrantConsentSetsCookie()
223223
Assert.Equal("yes", consentCookie.Value);
224224
Assert.True(consentCookie.Expires.HasValue);
225225
Assert.True(consentCookie.Expires.Value > DateTimeOffset.Now + TimeSpan.FromDays(364));
226-
Assert.Equal(Net.Http.Headers.SameSiteMode.Lax, consentCookie.SameSite);
226+
Assert.Equal(Net.Http.Headers.SameSiteMode.None, consentCookie.SameSite);
227227
Assert.NotNull(consentCookie.Expires);
228228
var testCookie = cookies[1];
229229
Assert.Equal("Test", testCookie.Name);
230230
Assert.Equal("Value", testCookie.Value);
231-
Assert.Equal(Net.Http.Headers.SameSiteMode.Lax, testCookie.SameSite);
231+
Assert.Equal(Net.Http.Headers.SameSiteMode.None, testCookie.SameSite);
232232
Assert.Null(testCookie.Expires);
233233
}
234234

@@ -302,7 +302,7 @@ public async Task GrantConsentWhenAlreadyHasItDoesNotSetCookie()
302302
return Task.CompletedTask;
303303
});
304304

305-
Assert.Equal("Test=Value; path=/; samesite=lax", httpContext.Response.Headers[HeaderNames.SetCookie]);
305+
Assert.Equal("Test=Value; path=/", httpContext.Response.Headers[HeaderNames.SetCookie]);
306306
}
307307

308308
[Fact]
@@ -400,12 +400,12 @@ public async Task WithdrawConsentDeletesCookie()
400400
var testCookie = cookies[0];
401401
Assert.Equal("Test", testCookie.Name);
402402
Assert.Equal("Value1", testCookie.Value);
403-
Assert.Equal(Net.Http.Headers.SameSiteMode.Lax, testCookie.SameSite);
403+
Assert.Equal(Net.Http.Headers.SameSiteMode.None, testCookie.SameSite);
404404
Assert.Null(testCookie.Expires);
405405
var consentCookie = cookies[1];
406406
Assert.Equal(".AspNet.Consent", consentCookie.Name);
407407
Assert.Equal("", consentCookie.Value);
408-
Assert.Equal(Net.Http.Headers.SameSiteMode.Lax, consentCookie.SameSite);
408+
Assert.Equal(Net.Http.Headers.SameSiteMode.None, consentCookie.SameSite);
409409
Assert.NotNull(consentCookie.Expires);
410410
}
411411

@@ -486,7 +486,7 @@ public async Task WithdrawConsentAfterResponseHasStartedDoesNotDeleteCookie()
486486

487487
var reader = new StreamReader(httpContext.Response.Body);
488488
Assert.Equal("Started.Withdrawn.", await reader.ReadToEndAsync());
489-
Assert.Equal("Test=Value1; path=/; samesite=lax", httpContext.Response.Headers[HeaderNames.SetCookie]);
489+
Assert.Equal("Test=Value1; path=/", httpContext.Response.Headers[HeaderNames.SetCookie]);
490490
}
491491

492492
[Fact]
@@ -512,7 +512,7 @@ public async Task DeleteCookieDoesNotRequireConsent()
512512
var testCookie = cookies[0];
513513
Assert.Equal("Test", testCookie.Name);
514514
Assert.Equal("", testCookie.Value);
515-
Assert.Equal(Net.Http.Headers.SameSiteMode.Lax, testCookie.SameSite);
515+
Assert.Equal(Net.Http.Headers.SameSiteMode.None, testCookie.SameSite);
516516
Assert.NotNull(testCookie.Expires);
517517
}
518518

@@ -576,7 +576,7 @@ public async Task CreateConsentCookieMatchesGrantConsentCookie()
576576
var consentCookie = cookies[0];
577577
Assert.Equal(".AspNet.Consent", consentCookie.Name);
578578
Assert.Equal("yes", consentCookie.Value);
579-
Assert.Equal(Net.Http.Headers.SameSiteMode.Lax, consentCookie.SameSite);
579+
Assert.Equal(Net.Http.Headers.SameSiteMode.None, consentCookie.SameSite);
580580
Assert.NotNull(consentCookie.Expires);
581581

582582
cookies = SetCookieHeaderValue.ParseList(httpContext.Response.Headers["ManualCookie"]);
@@ -657,4 +657,4 @@ private Task<HttpContext> RunTestAsync(Action<CookiePolicyOptions> configureOpti
657657
return server.SendAsync(configureRequest);
658658
}
659659
}
660-
}
660+
}

0 commit comments

Comments
 (0)