I have a project with a backend .NET code base, which after successful user verification, sends a Set-Cookie, which is httpOnly. This cookie is used on subsequent requests to the protected APIs.
The frontend is made in ReactJS.
Backend server – api.azurewebsites.net
Frontend server – app.azurewebsites.net
// Set token in cookie
public void SetTokenInCookie(HttpContext httpContext, string token)
{
var cookieOptions = new CookieOptions
{
Secure = true,
SameSite = SameSiteMode.None,
Expires = DateTime.UtcNow.AddMinutes(30),
HttpOnly = true,
};
httpContext.Response.Cookies.Append("access_token", token, cookieOptions);
}
This code works fine in all web browsers on both Windows and Android, but not on iOS devices.
The cookie seems to get lost on page reload, and any subsequent API call gets a 401.
PS.
- I had changed the SameSite = SameSiteMode.None to SameSite = SameSiteMode.Lax after reading a few other articles, but that didnot solve the issue, and caused problems with other devices as well.