title: Is there a way to apply SameSite attribute to .AspNetCore.Correlation cookie?
body: <p>Following the recent changes in <a href="https://blog.chromium.org/2019/10/developers-get-ready-for-new.html" rel="nofollow noreferrer">Chrome 80</a>, it is now required to specify <code>SameSite=None</code> on the cookies that needs to be sent across different sites.</p>
  
  <p>I have identified an issue with my Asp.Net Core site when hosted on a frame on a different site. The WS-Federation authentication is currently broken because the <code>SameSite=None</code> attribute is missing from the .AspNetCore.Correlation cookie:</p>
  
  <pre><code>Set-Cookie: .AspNetCore.Correlation.WsFederation.qG-dtdsIcVBHSRW4SpPpqpMYMrueIrLfWLvElKrbyXg=N; expires=Fri, 17 Jan 2020 09:17:08 GMT; path=/signin-wsfed; secure; httponly
  </code></pre>
  
  <p>I have found a way to add <code>SameSite=None</code> to the cookie using the <a href="https://docs.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-3.1#cookie-policy-middleware" rel="nofollow noreferrer">Cookie Policy Middleware</a>:</p>
  
  <pre><code>app.UseCookiePolicy(new CookiePolicyOptions()
  {
      MinimumSameSitePolicy = SameSiteMode.None
  });
  </code></pre>
  
  <p>This works fine, but this causes ALL cookies to be created with this attribute, which I would like to avoid. Would there be a less intrusive solution that could be applied to the correlation cookie only?</p>