3

I have an application written in ASP.NET 4.0. All was working fine till google chrome introduced this samesite cookie default value to 'lex'.

There is a solution of handling samesite cookie in asp.net version 4.7.2.

https://learn.microsoft.com/en-us/aspnet/samesite/system-web-samesite

But I am unable to find any solution for version 4.0. Do I need to upgrade from 4.0 to 4.7.2 ?

MAXE
  • 4,978
  • 2
  • 45
  • 61
Adeel
  • 413
  • 1
  • 7
  • 22

3 Answers3

3

This also works before 4.7.2:

Response.Headers.Add("set-cookie", "mysessioncookie=theValue; path=/; SameSite=Strict")

Wolfgang Grinfeld
  • 870
  • 10
  • 11
0

Short answer: It seems that Yes, they are forcing us to upgrade.

Why?: "The updated standard is not backward compatible with the previous standard[...]Microsoft does not support .NET versions lower that 4.7.2 for writing the same-site cookie attribute."

Source:https://learn.microsoft.com/en-us/aspnet/samesite/system-web-samesite

Maybe this can help you: Adding Same-site; Secure to Cookies in Classic ASP

Have I made it work in my own apps?:Not reliably yet :(

Alan Warden
  • 188
  • 8
-1

Do I need to upgrade from 4.0 to 4.7.2 - Yes ,
Build you solution with .net target framework 4.7.2
update web.config
compilation targetFramework 4.7.2
httpRuntime targetFramework 4.7.2
update samesite option to Strict, Lax, or None as per your application requirement httpCookie.SameSite to SameSiteMode.Lax

Chrome browser SameSite cookie Update
SameSite Cookie Changes in ASP.NET and ASP.NET Core

Eduard Keilholz
  • 820
  • 8
  • 27
Sachin Patil
  • 1
  • 2
  • No, you do not _**need**_ to upgrade to .NET 4.7.2 in order to handle samesite cookies. You _**should**_ upgrade as .NET 4.0 is now end-of-life, but it's not a requirement. – Dan Atkinson Nov 17 '22 at 22:35