7

I have the following session config in Startup.cs

    public void ConfigureServices(IServiceCollection services)
    {
        services.Configure<CookiePolicyOptions>(options =>
        {
            options.CheckConsentNeeded = context => false;
            options.MinimumSameSitePolicy = SameSiteMode.None;
        });


        services.AddDistributedMemoryCache();

        services.AddSession(options =>
        {
            // Set a short timeout for easy testing.
            options.IdleTimeout = TimeSpan.FromSeconds(10);
            options.Cookie.HttpOnly = true;

            // Make the session cookie essential
            options.Cookie.IsEssential = true;
        });
     }

Everything works fine and the session keeps it Session Id and data. I'm putting some booking info there. Then I redirect a user to payment page. After successful payment the user is redirected back to my site via POST to PaymentController Success action.

Obviously, this POST request from payment platform doesn't contain session cookies, so I just do RedirectToAction("ContinueBooking","Payment") inside PaymentController Success action.

After redirect to action - the browser sends session cookies but the session seems to be lost at this time and a new session Id assigned, all data is lost. Is there any way to prevent this ? Or should I just use database to store data between redirects in my case (i can bypass some parameters through payment terminal)?

10
  • exist app.UseSession(); in Configure method in startup?
    – hassan.ef
    Apr 23, 2019 at 15:19
  • @hassan.ef sure
    – lavrik
    Apr 23, 2019 at 15:22
  • 1
    Show the actual controller code. Apr 23, 2019 at 15:31
  • 2
    I solved it problem with this solution: stackoverflow.com/a/50425129/2238515
    – Almeida
    Jul 2, 2019 at 19:06
  • 1
    @CleverAlmeida thanks. In my case I need consent cookies. For me the issues was fixed by setting AddSession(x=> x.Cookie.HttpOnly=true; x.Cookie.IsEssentialTrue=true; options.IdleTimeout = Somebigvalue)
    – lavrik
    Jul 3, 2019 at 10:32

2 Answers 2

3

If both apps are on same server then both will be same cookie and first cookie will be overwritten by the payment app's session cookie. To avoid this customize the cookie name:

services.AddSession(opt => { opt.Cookie.Name = "MySessionCookie"; });

2
  • Thanks, solved issue I was having with authorization cookie. Ended up, in development, was being overwritten when redirecting between different ports. Feb 2, 2021 at 4:14
  • This was the one for me. I was trying to implement 2FA with Duo and every time Duo redirected the browser back to my app endpoint the session was empty so I couldn't verify the response. I'd tried all sorts of reasonable-sounding configuration options for the session cookie, but this was the one that finally made the difference. Nov 18, 2022 at 12:12
0

I've the same scenario, i need to redirect to another site (identity gateway), and this site post returns response identification with http post.

For me, with .net core 3.1 for create session cookie with samesite none i need to use options.Cookie.SecurePolicy.

Without this, no cookie is created..

services
    .Configure<CookiePolicyOptions>(options =>
    {
        // not necessary
        //options.MinimumSameSitePolicy = SameSiteMode.None;
    })
    .AddSession(options =>
    {
        options.Cookie.HttpOnly = true;
        options.Cookie.IsEssential = true;
        options.Cookie.SameSite = SameSiteMode.None;
        options.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest; // this is the key
    })

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.