How to configure httponly and secure flag in .net core 2.0?

Question

There is no error But I am unable to configuration httponly status in browser. Can you check my code please.

public void ConfigureServices(IServiceCollection services)
    {
        services.AddDistributedMemoryCache();
        services.AddMvc();
        services.AddSession(options =>
        {
            // Set a short timeout for easy testing.
            options.IdleTimeout = TimeSpan.FromMinutes(20);
            options.Cookie.HttpOnly = true;
            options.Cookie.SameSite = SameSiteMode.Strict;
            options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
          });
      }
 public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
       app.UseSession();
        app.UseStaticFiles();

        app.UseCookiePolicy(new CookiePolicyOptions
        {
            HttpOnly = HttpOnlyPolicy.Always,
            Secure =CookieSecurePolicy.Always,
            MinimumSameSitePolicy=SameSiteMode.None
        });
      }

Please explain what exactly and specifically you want to do and what is the problem you are facing. — Tiago Martins Peres, Mar 19 '18 at 12:12
Post the *text* of the exception you're receiving and your code as *text* as well. Images can be used to aid understanding, but your question must be able to stand on its own without them. — Chris Pratt, Mar 19 '18 at 13:32
In the chrome browser Setting-under Advance - content settings - cookies -See all cookies and site data - click in site name Flag are should be - Accessible to script No (HttpOnly) and Send for Secure connections only — Raju Pandey, Mar 20 '18 at 04:04

score 4 · Answer 1 · edited Aug 06 '19 at 05:08

4

According to the documentation you can configure HttpOnly via IApplicationBuilder.UseCookiePolicy():

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    /*..*/
    app.UseStaticFiles();
    app.UseSession();
    app.UseCookiePolicy(new CookiePolicyOptions
    {
        HttpOnly = HttpOnlyPolicy.Always
    });
}

edited Aug 06 '19 at 05:08

Serj Sagan

28,927
17
154
183

answered Mar 19 '18 at 12:19

Marco

22,856
9
75
124

Thank you for you Answer, There is no error But I am still unable to configuration httponly status in browser. – Raju Pandey Mar 20 '18 at 09:01
public void Configure(IApplicationBuilder app, IHostingEnvironment env) { app.UseSession(); app.UseStaticFiles(); app.UseCookiePolicy(new CookiePolicyOptions { HttpOnly = HttpOnlyPolicy.Always, Secure =CookieSecurePolicy.Always, MinimumSameSitePolicy=SameSiteMode.None }); } – Raju Pandey Mar 20 '18 at 09:03
public void ConfigureServices(IServiceCollection services) { services.AddDistributedMemoryCache(); services.AddMvc(); services.AddSession(options => { options.IdleTimeout = TimeSpan.FromMinutes(20); options.Cookie.HttpOnly = true; options.Cookie.SameSite = SameSiteMode.Strict; options.Cookie.SecurePolicy = CookieSecurePolicy.Always; }); } – Raju Pandey Mar 20 '18 at 09:04
2

Please edit your question. Do not post code as a comment. This is unreadable – Marco Mar 20 '18 at 09:13
1

In case it helps anyone else, this didn't work when I put it at the end of the Configure method, but did when I moved it higher up. – Evan Oct 13 '20 at 19:22
@Evan Yes - order matters when using middleware. – Marco Oct 13 '20 at 19:27

score 3 · Answer 2 · answered Aug 13 '18 at 21:16

In ASP.NET Core 2.X you can use the following code:

public void ConfigureServices(IServiceCollection services)
{
     // This can be removed after https://github.com/aspnet/IISIntegration/issues/371
     services.AddAuthentication(
        options =>
        {
             //Blah Blah Blah
         }).AddCookie(opts =>
         {
              opts.Cookie.HttpOnly = false;
          });
 }

 public void Configure(IApplicationBuilder app)
 {
     app.UseAuthentication();
 }

Note that this changed from ASP.NET Core 1.X

How to configure httponly and secure flag in .net core 2.0?

2 Answers2