title: how to protect Google Chrome 80 beta asp + iframe
body: <p>The web service environment is operated by Windows 2012 server, IIS8.5, Classic asp.</p>
  
  <p>this is problem about Chrome 80ver SameSite Issue.</p>
  
  <p>On our site, we make payments by calling iframes and receive the results by returnurl.
  However, there is a problem in returnurl that changes the existing session value (sometimes it is maintained and sometimes it is changed).</p>
  
  <p>I tried to 
  First.  Add header in source code as follows</p>
  
  <pre><code>Response.AddHeader "Set-Cookie", "SameSite=None; Secur; path=/; HttpOnly" 
  </code></pre>
  
  <p>Second. Add web.config </p>
  
  <pre><code>&lt;system.web&gt;
  &lt;httpCookies httpOnlyCookies="true" requireSSL="true" sameSite="None" /&gt;
  &lt;sessionState cookieSameSite="None" /&gt;
  </code></pre>
  
  <p></p>
  
  <p>Third.  Add web.config rewrite</p>
  
  <pre><code>&lt;rewrite&gt;
   &lt;outboundRules&gt;
      &lt;rule name="AddSameSiteCookieFlag"&gt;
         &lt;match serverVariable="RESPONSE_Set-Cookie" pattern="^(.*SessionID)(SameSite=Lax)" /&gt;
         &lt;action type="Rewrite" value="{R:1};SameSite=None" /&gt;
      &lt;/rule&gt;
  &lt;/outboundRules&gt;
  </code></pre>
  
  <p></p>
  
  <p>Is there a way to set the samesite setting to none in IIS8.5?</p>