I am setting SameSite in Startup.Auth.cs like:
CookiePath = “/; SameSite=Lax”,
But for Login action, on redirection; the Set-Cookie value is being automatically set by the Framework and not by code. The issue is that the Set-Cookie that is a Response Header is having .AspNet.ApplicationCookie as its value. This is a very big vulnerability as the Cookie is being exposed as part of response.
This is the state that I am getting for redirected Login action with HTTPResponseCode 302:
Set-Cookie is having .AspNet.ApplicationCookie
How to avoid/disable this vulnerability?
As described in the question, the scenario is to be avoided.
Urja Sehgal is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.