title: how SameSite attribute added to my Asp.net_SessionID cookie automatically?
body: <p>Recently samesite=lax add automatically to my session cookie!
  this attribute just add to sessionID:
  <code>"Set-Cookie  ASP.NET_SessionId=zana3mklplqwewhwvika2125; path=/; HttpOnly; **SameSite=Lax**"</code></p>
  
  <p>My website hosted on IIS 8.5, Windows 2012 R2, and dont have WAF or UrlRewrite and I turn off AntiVirus (kasper).</p>
  
  <p>but yet have same problem on some customer servers.</p>
  
  <p>any idea?</p>
  
  <p><strong>EDITED:</strong>
  I Find this:
  <a href="https://support.microsoft.com/en-us/help/4524419/kb4524419" rel="noreferrer">https://support.microsoft.com/en-us/help/4524419/kb4524419</a></p>
  
  <blockquote>
    <p>ASP.NET will now emit a SameSite cookie header when HttpCookie.SameSite value is 'None' to accommodate upcoming changes to SameSite cookie handling in Chrome. As part of this change, FormsAuth and SessionState cookies will also be issued with SameSite = 'Lax' instead of the previous default of 'None', though these values can be overridden in web.config.</p>
  </blockquote>
  
  <p>How can i overridde samesite cookies for SessionState in web.config?
  i add this line, but it not work on SessionID cookie!
  <code>&lt;httpCookies sameSite="Unspecified" /&gt;</code></p>
  
  <p><strong>EDITED:</strong> I find this: <a href="https://docs.microsoft.com/en-us/dotnet/api/system.web.configuration.sessionstatesection.cookiesamesite?view=netframework-4.8#System_Web_Configuration_SessionStateSection_CookieSameSite" rel="noreferrer">https://docs.microsoft.com/en-us/dotnet/api/system.web.configuration.sessionstatesection.cookiesamesite?view=netframework-4.8#System_Web_Configuration_SessionStateSection_CookieSameSite</a></p>
  
  <p>Set samesite for stateserver by "cookieSameSite" attribute of SessionState tag.</p>