OpenID Connect correlation cookie and changes to SameSite=None Cookie-Handling
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
According to https://developer.chrome.com/en/blog/progress-in-the-privacy-sandbox-2021-12/ there are going to be changes in the handling of cookies with SameSite=None.
When using the OpenID Connect authentication the base classes are used that issue and validate a correlation cookie with SameSite=None, so this cookie is affected by the change.
See
- https://github.com/dotnet/aspnetcore/blob/b89eba6c3cda331ee98063e3c4a04267ec540315/src/Security/Authentication/OAuth/src/OAuthHandler.cs
- https://github.com/dotnet/aspnetcore/blob/b89eba6c3cda331ee98063e3c4a04267ec540315/src/Security/Authentication/Core/src/RemoteAuthenticationHandler.cs
Could you please share the plans how to deal with this issue? Is this going to be fixed in aspnetcore?
Contributor guide
Assessment
This issue has not been assessed yet.