ARTICLE AD BOX
In Program.cs I have configured cookie like so:
.AddCookie(options => { options.Cookie.HttpOnly = true; options.Cookie.SecurePolicy = CookieSecurePolicy.Always; })I have noticed that Cookies without SameSite are treated as Lax by default.
Should I set SameSite=None if my MVC app uses Entra ID as an identity provider?
From what I can see is that Entra does cross-site callback to the application during authentication.
My understanding is that I should do something like this instead:
.AddCookie(options => { options.Cookie.HttpOnly = true; options.Cookie.SecurePolicy = CookieSecurePolicy.Always; options.Cookie.SameSite = SameSiteMode.None; })Documentation links would be appreciated
