title: Cookies' SameSite=None setting being lost
body: <p>We have an ASP.NET based website. We have a requirement to run the site in a 3rd party's iframe. Various parts of the site recently stopped working in this iframe scenario and we've narrowed it down to user's using Chrome and the AspNet.ApplicationCookie as well as a couple custom cookies not being available while in the iframe (no issues running outside the iframe).</p>
  <p>The site uses OWIN authentication, so I was able to upgrade to ASP.NET 4.8 and the OWIN Nuget packages. This allowed me to set the <code>CookieSameSite</code> property in the <code>CookieAuthenticationOptions</code> of the <code>IAppBuilder</code>. After that I can see the AspNet.ApplicationCookie was being marked as Secure and SameSite=None. Perfect.</p>
  <p>For the custom cookies however, I can't seem to get the SameSite setting to work. Code for the cookie creation is:</p>
  <pre><code>HttpContext.Current.Response.SetCookie(new HttpCookie(key, value)
  {
      Expires = expiration,
      SameSite = SameSiteMode.None,
      Secure = true
  });
  </code></pre>
  <p>These cookies work outside the iframe. Using Chrome and Firefox dev tools I see they are marked as Secure but the SameSite setting is not set (specifically shows &quot;unspecified&quot; in Firefox dev tools) so they are still unavailable when running in the iframe.</p>
  <p>Some related things:</p>
  <ul>
  <li>We installed the latest 4.8 version of the .net framework so I don't believe we need to install any patches on the server to support SameSite.</li>
  <li>Locally, the cookies' settings look correct. I can see cookies marked as Secure and SameSite=None. However this is failing on a load balanced server setup (2 Windows 2016 servers behind a load balancer).</li>
  <li>Using chrome://flags/, I can set the <code>SameSite by default cookies</code> to Disabled and everything works as expected in the iframe. (I think this just validates that the issue is indeed SameSite).</li>
  <li>I've tried to set the SameSite setting with config as well to no avail: <code>&lt;httpCookies requireSSL=&quot;true&quot; sameSite=&quot;None&quot; /&gt;</code></li>
  </ul>
  <p>Am I creating the cookies wrong? Am I wrong about not needing a patch? Is there some way to determine if the load balancer is somehow to blame?</p>
  <p><strong>UPDATE - 8/17/2020</strong></p>
  <p>I've gotten no closer to explaining this. Something that does work for me is to use an outbound IIS rewrite to add &quot;Secure; SameSite=None;&quot; to all cookies - this seemed to be the common way to resolve this issue before the 4.7.2 and 4.8 updates.</p>
  <p>The rewrite does ensure <code>SameSite</code> and <code>Secure</code> are set as expected. To me, that rules out the load balancer affecting cookies in any way.</p>
  <p>If I am correct, that leaves just a code issue but, man, it seems pretty straightforward.</p>