dotnet / dotnet/AspNetCore.Docs
[Clarification] How could we use Cookie Auth -> Client and oAuth2 -> external API ?
- Dominant language
- C#
- Stars
- 13.1k
- Forks
- 24.6k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 109
Description
### Description
At this [Section of this Page](https://learn.microsoft.com/de-de/aspnet/core/security/authentication/cookie?view=aspnetcore-9.0#cookie-policy-middleware), I would like to get some information/clarification 🤔 💡
It says as far as I would understand this, that we need to define `CookiePolicyOptions` like this, with "Strict" for using CookieAuthentication:
```csharp
var cookiePolicyOptions = new CookiePolicyOptions
{
MinimumSameSitePolicy = SameSiteMode.Strict,
};
```
Which I would aggree with for security reasons 👍
But this also says then, that this disables oAuth2 using 👀
Now my problem is, I would like to use CookieAuth as initial and simplest Authentication from my Client to my Server, but I would want to send requests to this [external Api](https://developers.etsy.com/documentation/essentials/authentication#requesting-an-oauth-token) using oAuth2 to work with the fetched data on my Users Behalf.
If you following the link, to this, you will see that its requiring me to use cors/antiforgery, which I am going to implement, and from what I am reading, I would also need https. My Client WebAssembly does run on https, so that should be fine, my Server also.
But it would be a big problem for me, if I could not use oAuth2 like described.
Could you tell me, if I missunderstand this statement on this page and let me know?
### Page URL
https://learn.microsoft.com/de-de/aspnet/core/security/authentication/cookie?view=aspnetcore-9.0
### Content source URL
https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/security/authentication/cookie.md
### Document ID
b18a015b-914d-f014-f711-120d208904d9
### Platform Id
65dc346c-b9fc-27d6-5769-bf45e510ebae
### Article author
@Rick-Anderson
### Metadata
* ID: d2229fc6-f8c8-952e-e567-b1d5a463055a
* PlatformId: 65dc346c-b9fc-27d6-5769-bf45e510ebae
* Service: **aspnet-core**
* Sub-service: **security**
[Related Issues](https://github.com/dotnet/AspNetCore.Docs/issues?q=is%3Aissue+is%3Aopen+b18a015b-914d-f014-f711-120d208904d9)
Contributor guide
Assessment
This issue has not been assessed yet.