dotnet / dotnet/AspNetCore.Docs

[Clarification] How could we use Cookie Auth -> Client and oAuth2 -> external API ?

Open
#35,814 0 comments 0 reactions 1 assignee Claimed by @wadepickett View on GitHub
aspnet-core/svc security/subsvc Source - Docs.ms
Dominant language
C#
Stars
13.1k
Forks
24.6k
Avg merge
1d 2h
Merged PRs (30d)
109

Description

### Description

At this [Section of this Page](https://learn.microsoft.com/de-de/aspnet/core/security/authentication/cookie?view=aspnetcore-9.0#cookie-policy-middleware), I would like to get some information/clarification 🤔 💡

It says as far as I would understand this, that we need to define `CookiePolicyOptions` like this, with "Strict" for using CookieAuthentication:

```csharp
var cookiePolicyOptions = new CookiePolicyOptions
{
MinimumSameSitePolicy = SameSiteMode.Strict,
};
```
Which I would aggree with for security reasons 👍
But this also says then, that this disables oAuth2 using 👀
Now my problem is, I would like to use CookieAuth as initial and simplest Authentication from my Client to my Server, but I would want to send requests to this [external Api](https://developers.etsy.com/documentation/essentials/authentication#requesting-an-oauth-token) using oAuth2 to work with the fetched data on my Users Behalf.
If you following the link, to this, you will see that its requiring me to use cors/antiforgery, which I am going to implement, and from what I am reading, I would also need https. My Client WebAssembly does run on https, so that should be fine, my Server also.

But it would be a big problem for me, if I could not use oAuth2 like described.
Could you tell me, if I missunderstand this statement on this page and let me know?

### Page URL

https://learn.microsoft.com/de-de/aspnet/core/security/authentication/cookie?view=aspnetcore-9.0

### Content source URL

https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/security/authentication/cookie.md

### Document ID

b18a015b-914d-f014-f711-120d208904d9

### Platform Id

65dc346c-b9fc-27d6-5769-bf45e510ebae

### Article author

@Rick-Anderson

### Metadata

* ID: d2229fc6-f8c8-952e-e567-b1d5a463055a
* PlatformId: 65dc346c-b9fc-27d6-5769-bf45e510ebae
* Service: **aspnet-core**
* Sub-service: **security**

[Related Issues](https://github.com/dotnet/AspNetCore.Docs/issues?q=is%3Aissue+is%3Aopen+b18a015b-914d-f014-f711-120d208904d9)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.