3

I am trying to set a cookie with Expires date:

response.Cookies.Append("theKey", value, new CookieOptions() { Expires = DateTime.Now.AddMonths(12) });

the cookie is stored in the browser but is not sent in a subsequent cross-site web request.

When I try set the cookie without the Expires date, the cookie is sent, but it is stored in the browser only while the browser is open (session cookie).

It is a cross-site request. The javascript code that calls the function is:

var xmlHttp = new XMLHttpRequest();
xmlHttp.open("GET", url, true);
xmlHttp.withCredentials = true;
xmlHttp.onreadystatechange = function () {
    if (this.readyState == 4 && this.status == 200) {
        //console.log(this.responseText);
    }
};
xmlHttp.send(null);

Is there a way to send a cookie containing Expires date in a cross-site request?

Both the client web app and the function app (that attempts to set the cookie) use https.

This is the HTTP response setting the cookie with expiration date:

enter image description here

5
  • @MartinStaufcik if you use Postman, do you get the same behaviour? Postman does not check for cross origin, so you can try to keep your code as it is and remove CORS, and check if the cookie is passed correcly in the response.
    – Norcino
    Commented Mar 1, 2019 at 10:50
  • Apart from figuring out why this happens, If you save this for a year, then why not just use localStorage
    – mplungjan
    Commented Mar 1, 2019 at 10:53
  • @mplungjan I cannot use localStorage, because I need to be able to send the cookie in a subsequent web request, it identifies the user Commented Mar 1, 2019 at 11:06
  • But then you can send it without expiry at least
    – mplungjan
    Commented Mar 1, 2019 at 11:20
  • @Manuel I tried to look into the cookies of the other domain in Chrome, the cookie is saved in the browser, so the problem is the cookie is not sent in subsequent request. I will probably solve it by creating a first domain cookie in javascript and sending it as a parameter in the ajax call. Commented Mar 1, 2019 at 14:32

2 Answers 2

9

The solution is to set the cookie's SameSite attribute. This allows sending the cookie along with cross-site requests from JavaScript code.

Possible values of SameSite attribute (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite):

  • strict - the cookie is not sent for cross-site requests
  • lax (the default) - the cookie is sent for cross-site requests only when the user follows a regular link (e.g. clicking)
  • none (previous default) - the cookie is sent for cross-site requests

In .NET Core, the cookie needs to be explicitly set with the SameSite attribute, since the default is lax:

response.Cookies.Append("theCookie", value, new CookieOptions() 
{ 
    Expires = DateTime.Now.AddMonths(12), 
    SameSite = Microsoft.AspNetCore.Http.SameSiteMode.None 
});
2
  • It works if i set samesite as none as you describe. Is it less secure than "samesite" ?
    – Cozdemir
    Commented Apr 29, 2021 at 18:39
  • Yes, it's less secure by default. If it's a session ID, for instance, other websites can send requests and be automatically authenticated. There are, however, other mechanisms implemented in the browser to prevent this, such as Access-Control-Allow-Origin.
    – Druckles
    Commented Aug 11, 2021 at 13:18
5

You server needs to include the following CORS response header:

 Access-Control-Allow-Credentials: true

in addition to the Access-Control-Allow-Origin header you're already sending.

Without the ACAC header, the browser will not process any Set-Cookieresponse headers from the origin. I suspect the cookie is being set by a Set-Cookie response header in a different response.

3
  • Which server? If a browser hits site A and gets a cookie back, then the user (on the same page) hits site B - what needs to happen for the cookie to be received by site B? Note that both sites are in the same domain, but apparently "samesite" doesn't account for that.
    – djsoteric
    Commented Dec 17, 2019 at 15:21
  • 1
    If both sites are in the same domain (even the same base domain, e.g. if A is foo.example.com and B is bar.example.com), if foo.example.com created a cookie (via the Set-Cookie response header) with the Domain attribute as ".example.com", then IN THEORY, it will be passed to bar.example.com. But if the request to foo.example.com was a CORS request which didn't return ACAC: true, then the browser would 'dump' the Set-Cookie header, and it would never be created...
    – roryhewitt
    Commented Dec 17, 2019 at 21:05
  • Ok, I'm glad that this should work. I have set up sites that are on the same domain like your example. I can see the cookie being passed back and forth with site A but it never makes it to site B even with this header and the origin one set. The cookie is set to samesite but the domains are exactly the same (different ports, if that matters). I'll work through it for a bit and open a question if I can't get it.
    – djsoteric
    Commented Dec 17, 2019 at 21:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.