diff --git a/eng/PatchConfig.props b/eng/PatchConfig.props index 71ff8312fdf9..3ba7babc5710 100644 --- a/eng/PatchConfig.props +++ b/eng/PatchConfig.props @@ -40,6 +40,8 @@ Later on, this will be checked using this condition: + Microsoft.Net.Http.Headers; + Microsoft.AspNetCore.CookiePolicy; diff --git a/src/Http/Headers/src/SetCookieHeaderValue.cs b/src/Http/Headers/src/SetCookieHeaderValue.cs index f3477648dee2..e72f02b04869 100644 --- a/src/Http/Headers/src/SetCookieHeaderValue.cs +++ b/src/Http/Headers/src/SetCookieHeaderValue.cs @@ -19,8 +19,14 @@ public class SetCookieHeaderValue private const string SecureToken = "secure"; // RFC Draft: https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site-00 private const string SameSiteToken = "samesite"; + private static readonly string SameSiteNoneToken = SameSiteMode.None.ToString().ToLower(); private static readonly string SameSiteLaxToken = SameSiteMode.Lax.ToString().ToLower(); private static readonly string SameSiteStrictToken = SameSiteMode.Strict.ToString().ToLower(); + + // True (old): https://tools.ietf.org/html/draft-west-first-party-cookies-07#section-3.1 + // False (new): https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03#section-4.1.1 + internal static bool SuppressSameSiteNone; + private const string HttpOnlyToken = "httponly"; private const string SeparatorToken = "; "; private const string EqualsToken = "="; @@ -34,6 +40,14 @@ public class SetCookieHeaderValue private StringSegment _name; private StringSegment _value; + static SetCookieHeaderValue() + { + if (AppContext.TryGetSwitch("Microsoft.AspNetCore.SuppressSameSiteNone", out var enabled)) + { + SuppressSameSiteNone = enabled; + } + } + private SetCookieHeaderValue() { // Used by the parser to create a new instance of this type. @@ -90,11 +104,11 @@ public StringSegment Value public bool Secure { get; set; } - public SameSiteMode SameSite { get; set; } + public SameSiteMode SameSite { get; set; } = SuppressSameSiteNone ? SameSiteMode.None : (SameSiteMode)(-1); // Unspecified public bool HttpOnly { get; set; } - // name="value"; expires=Sun, 06 Nov 1994 08:49:37 GMT; max-age=86400; domain=domain1; path=path1; secure; samesite={Strict|Lax}; httponly + // name="value"; expires=Sun, 06 Nov 1994 08:49:37 GMT; max-age=86400; domain=domain1; path=path1; secure; samesite={strict|lax|none}; httponly public override string ToString() { var length = _name.Length + EqualsToken.Length + _value.Length; @@ -130,9 +144,20 @@ public override string ToString() length += SeparatorToken.Length + SecureToken.Length; } - if (SameSite != SameSiteMode.None) + // Allow for Unspecified (-1) to skip SameSite + if (SameSite == SameSiteMode.None && !SuppressSameSiteNone) + { + sameSite = SameSiteNoneToken; + length += SeparatorToken.Length + SameSiteToken.Length + EqualsToken.Length + sameSite.Length; + } + else if (SameSite == SameSiteMode.Lax) { - sameSite = SameSite == SameSiteMode.Lax ? SameSiteLaxToken : SameSiteStrictToken; + sameSite = SameSiteLaxToken; + length += SeparatorToken.Length + SameSiteToken.Length + EqualsToken.Length + sameSite.Length; + } + else if (SameSite == SameSiteMode.Strict) + { + sameSite = SameSiteStrictToken; length += SeparatorToken.Length + SameSiteToken.Length + EqualsToken.Length + sameSite.Length; } @@ -172,7 +197,7 @@ public override string ToString() AppendSegment(ref sb, SecureToken, null); } - if (SameSite != SameSiteMode.None) + if (sameSite != null) { AppendSegment(ref sb, SameSiteToken, sameSite); } @@ -235,9 +260,18 @@ public void AppendToStringBuilder(StringBuilder builder) AppendSegment(builder, SecureToken, null); } - if (SameSite != SameSiteMode.None) + // Allow for Unspecified (-1) to skip SameSite + if (SameSite == SameSiteMode.None && !SuppressSameSiteNone) + { + AppendSegment(builder, SameSiteToken, SameSiteNoneToken); + } + else if (SameSite == SameSiteMode.Lax) { - AppendSegment(builder, SameSiteToken, SameSite == SameSiteMode.Lax ? SameSiteLaxToken : SameSiteStrictToken); + AppendSegment(builder, SameSiteToken, SameSiteLaxToken); + } + else if (SameSite == SameSiteMode.Strict) + { + AppendSegment(builder, SameSiteToken, SameSiteStrictToken); } if (HttpOnly) @@ -289,7 +323,7 @@ public static bool TryParseStrictList(IList inputs, out IList= 0); @@ -424,25 +458,34 @@ private static int GetSetCookieLength(StringSegment input, int startIndex, out S { result.Secure = true; } - // samesite-av = "SameSite" / "SameSite=" samesite-value - // samesite-value = "Strict" / "Lax" + // samesite-av = "SameSite=" samesite-value + // samesite-value = "Strict" / "Lax" / "None" else if (StringSegment.Equals(token, SameSiteToken, StringComparison.OrdinalIgnoreCase)) { if (!ReadEqualsSign(input, ref offset)) { - result.SameSite = SameSiteMode.Strict; + result.SameSite = SuppressSameSiteNone ? SameSiteMode.Strict : (SameSiteMode)(-1); // Unspecified } else { var enforcementMode = ReadToSemicolonOrEnd(input, ref offset); - if (StringSegment.Equals(enforcementMode, SameSiteLaxToken, StringComparison.OrdinalIgnoreCase)) + if (StringSegment.Equals(enforcementMode, SameSiteStrictToken, StringComparison.OrdinalIgnoreCase)) + { + result.SameSite = SameSiteMode.Strict; + } + else if (StringSegment.Equals(enforcementMode, SameSiteLaxToken, StringComparison.OrdinalIgnoreCase)) { result.SameSite = SameSiteMode.Lax; } + else if (!SuppressSameSiteNone + && StringSegment.Equals(enforcementMode, SameSiteNoneToken, StringComparison.OrdinalIgnoreCase)) + { + result.SameSite = SameSiteMode.None; + } else { - result.SameSite = SameSiteMode.Strict; + result.SameSite = SuppressSameSiteNone ? SameSiteMode.Strict : (SameSiteMode)(-1); // Unspecified } } } @@ -520,4 +563,4 @@ public override int GetHashCode() ^ HttpOnly.GetHashCode(); } } -} \ No newline at end of file +} diff --git a/src/Http/Headers/test/SetCookieHeaderValueTest.cs b/src/Http/Headers/test/SetCookieHeaderValueTest.cs index e7e8bf045a12..32424363ddd8 100644 --- a/src/Http/Headers/test/SetCookieHeaderValueTest.cs +++ b/src/Http/Headers/test/SetCookieHeaderValueTest.cs @@ -57,7 +57,7 @@ public class SetCookieHeaderValueTest { SameSite = SameSiteMode.None, }; - dataset.Add(header7, "name7=value7"); + dataset.Add(header7, "name7=value7; samesite=none"); return dataset; @@ -155,9 +155,20 @@ public static TheoryData InvalidCookieValues { SameSite = SameSiteMode.Strict }; - var string6a = "name6=value6; samesite"; - var string6b = "name6=value6; samesite=Strict"; - var string6c = "name6=value6; samesite=invalid"; + var string6 = "name6=value6; samesite=Strict"; + + var header7 = new SetCookieHeaderValue("name7", "value7") + { + SameSite = SameSiteMode.None + }; + var string7 = "name7=value7; samesite=None"; + + var header8 = new SetCookieHeaderValue("name8", "value8") + { + SameSite = (SameSiteMode)(-1) // Unspecified + }; + var string8a = "name8=value8; samesite"; + var string8b = "name8=value8; samesite=invalid"; dataset.Add(new[] { header1 }.ToList(), new[] { string1 }); dataset.Add(new[] { header1, header1 }.ToList(), new[] { string1, string1 }); @@ -170,9 +181,10 @@ public static TheoryData InvalidCookieValues dataset.Add(new[] { header1, header2, header3, header4 }.ToList(), new[] { string.Join(",", string1, string2, string3, string4) }); dataset.Add(new[] { header5 }.ToList(), new[] { string5a }); dataset.Add(new[] { header5 }.ToList(), new[] { string5b }); - dataset.Add(new[] { header6 }.ToList(), new[] { string6a }); - dataset.Add(new[] { header6 }.ToList(), new[] { string6b }); - dataset.Add(new[] { header6 }.ToList(), new[] { string6c }); + dataset.Add(new[] { header6 }.ToList(), new[] { string6 }); + dataset.Add(new[] { header7 }.ToList(), new[] { string7 }); + dataset.Add(new[] { header8 }.ToList(), new[] { string8a }); + dataset.Add(new[] { header8 }.ToList(), new[] { string8b }); return dataset; } @@ -301,6 +313,28 @@ public void SetCookieHeaderValue_ToString(SetCookieHeaderValue input, string exp Assert.Equal(expectedValue, input.ToString()); } + [Fact] + public void SetCookieHeaderValue_ToString_SameSiteNoneCompat() + { + SetCookieHeaderValue.SuppressSameSiteNone = true; + + var input = new SetCookieHeaderValue("name", "value") + { + SameSite = SameSiteMode.None, + }; + + Assert.Equal("name=value", input.ToString()); + + SetCookieHeaderValue.SuppressSameSiteNone = false; + + var input2 = new SetCookieHeaderValue("name", "value") + { + SameSite = SameSiteMode.None, + }; + + Assert.Equal("name=value; samesite=none", input2.ToString()); + } + [Theory] [MemberData(nameof(SetCookieHeaderDataSet))] public void SetCookieHeaderValue_AppendToStringBuilder(SetCookieHeaderValue input, string expectedValue) @@ -312,6 +346,32 @@ public void SetCookieHeaderValue_AppendToStringBuilder(SetCookieHeaderValue inpu Assert.Equal(expectedValue, builder.ToString()); } + [Fact] + public void SetCookieHeaderValue_AppendToStringBuilder_SameSiteNoneCompat() + { + SetCookieHeaderValue.SuppressSameSiteNone = true; + + var builder = new StringBuilder(); + var input = new SetCookieHeaderValue("name", "value") + { + SameSite = SameSiteMode.None, + }; + + input.AppendToStringBuilder(builder); + Assert.Equal("name=value", builder.ToString()); + + SetCookieHeaderValue.SuppressSameSiteNone = false; + + var builder2 = new StringBuilder(); + var input2 = new SetCookieHeaderValue("name", "value") + { + SameSite = SameSiteMode.None, + }; + + input2.AppendToStringBuilder(builder2); + Assert.Equal("name=value; samesite=none", builder2.ToString()); + } + [Theory] [MemberData(nameof(SetCookieHeaderDataSet))] public void SetCookieHeaderValue_Parse_AcceptsValidValues(SetCookieHeaderValue cookie, string expectedValue) @@ -322,6 +382,31 @@ public void SetCookieHeaderValue_Parse_AcceptsValidValues(SetCookieHeaderValue c Assert.Equal(expectedValue, header.ToString()); } + [Fact] + public void SetCookieHeaderValue_Parse_AcceptsValidValues_SameSiteNoneCompat() + { + SetCookieHeaderValue.SuppressSameSiteNone = true; + var header = SetCookieHeaderValue.Parse("name=value; samesite=none"); + + var cookie = new SetCookieHeaderValue("name", "value") + { + SameSite = SameSiteMode.Strict, + }; + + Assert.Equal(cookie, header); + Assert.Equal("name=value; samesite=strict", header.ToString()); + SetCookieHeaderValue.SuppressSameSiteNone = false; + + var header2 = SetCookieHeaderValue.Parse("name=value; samesite=none"); + + var cookie2 = new SetCookieHeaderValue("name", "value") + { + SameSite = SameSiteMode.None, + }; + Assert.Equal(cookie2, header2); + Assert.Equal("name=value; samesite=none", header2.ToString()); + } + [Theory] [MemberData(nameof(SetCookieHeaderDataSet))] public void SetCookieHeaderValue_TryParse_AcceptsValidValues(SetCookieHeaderValue cookie, string expectedValue) @@ -332,6 +417,31 @@ public void SetCookieHeaderValue_TryParse_AcceptsValidValues(SetCookieHeaderValu Assert.Equal(expectedValue, header.ToString()); } + [Fact] + public void SetCookieHeaderValue_TryParse_AcceptsValidValues_SameSiteNoneCompat() + { + SetCookieHeaderValue.SuppressSameSiteNone = true; + Assert.True(SetCookieHeaderValue.TryParse("name=value; samesite=none", out var header)); + var cookie = new SetCookieHeaderValue("name", "value") + { + SameSite = SameSiteMode.Strict, + }; + + Assert.Equal(cookie, header); + Assert.Equal("name=value; samesite=strict", header.ToString()); + + SetCookieHeaderValue.SuppressSameSiteNone = false; + + Assert.True(SetCookieHeaderValue.TryParse("name=value; samesite=none", out var header2)); + var cookie2 = new SetCookieHeaderValue("name", "value") + { + SameSite = SameSiteMode.None, + }; + + Assert.Equal(cookie2, header2); + Assert.Equal("name=value; samesite=none", header2.ToString()); + } + [Theory] [MemberData(nameof(InvalidSetCookieHeaderDataSet))] public void SetCookieHeaderValue_Parse_RejectsInvalidValues(string value) diff --git a/src/Security/Authentication/OpenIdConnect/samples/OpenIdConnectSample/OpenIdConnectSample.csproj b/src/Security/Authentication/OpenIdConnect/samples/OpenIdConnectSample/OpenIdConnectSample.csproj index 6b34fabc6c8b..9fb07fe38f95 100644 --- a/src/Security/Authentication/OpenIdConnect/samples/OpenIdConnectSample/OpenIdConnectSample.csproj +++ b/src/Security/Authentication/OpenIdConnect/samples/OpenIdConnectSample/OpenIdConnectSample.csproj @@ -1,4 +1,4 @@ - + net461;netcoreapp2.1 @@ -12,6 +12,7 @@ + @@ -21,6 +22,7 @@ + diff --git a/src/Security/Authentication/OpenIdConnect/samples/OpenIdConnectSample/Startup.cs b/src/Security/Authentication/OpenIdConnect/samples/OpenIdConnectSample/Startup.cs index 1aa7625cb0f3..638a6050d76a 100644 --- a/src/Security/Authentication/OpenIdConnect/samples/OpenIdConnectSample/Startup.cs +++ b/src/Security/Authentication/OpenIdConnect/samples/OpenIdConnectSample/Startup.cs @@ -43,10 +43,33 @@ public Startup(IHostingEnvironment env) public IHostingEnvironment Environment { get; set; } + private void CheckSameSite(HttpContext httpContext, CookieOptions options) + { + if (options.SameSite > (SameSiteMode)(-1)) + { + var userAgent = httpContext.Request.Headers["User-Agent"].ToString(); + // TODO: Use your User Agent library of choice here. + if (userAgent.Contains("CPU iPhone OS 12") // Also covers iPod touch + || userAgent.Contains("iPad; CPU OS 12") + // Safari 12 and 13 are both broken on Mojave + || userAgent.Contains("Macintosh; Intel Mac OS X 10_14")) + { + options.SameSite = (SameSiteMode)(-1); + } + } + } + public void ConfigureServices(IServiceCollection services) { JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear(); + services.Configure(options => + { + options.MinimumSameSitePolicy = (SameSiteMode)(-1); + options.OnAppendCookie = cookieContext => CheckSameSite(cookieContext.Context, cookieContext.CookieOptions); + options.OnDeleteCookie = cookieContext => CheckSameSite(cookieContext.Context, cookieContext.CookieOptions); + }); + services.AddAuthentication(sharedOptions => { sharedOptions.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme; @@ -56,9 +79,15 @@ public void ConfigureServices(IServiceCollection services) .AddCookie() .AddOpenIdConnect(o => { + /* o.ClientId = Configuration["oidc:clientid"]; o.ClientSecret = Configuration["oidc:clientsecret"]; // for code flow o.Authority = Configuration["oidc:authority"]; + */ + // https://github.com/IdentityServer/IdentityServer4.Demo/blob/master/src/IdentityServer4Demo/Config.cs + o.ClientId = "server.hybrid"; + o.ClientSecret = "secret"; // for code flow + o.Authority = "https://demo.identityserver.io/"; o.ResponseType = OpenIdConnectResponseType.CodeIdToken; o.SaveTokens = true; @@ -88,6 +117,7 @@ public void ConfigureServices(IServiceCollection services) public void Configure(IApplicationBuilder app, IOptionsMonitor optionsMonitor) { app.UseDeveloperExceptionPage(); + app.UseCookiePolicy(); // Before UseAuthentication or anything else that writes cookies. app.UseAuthentication(); app.Run(async context => diff --git a/src/Security/Authentication/test/CookieTests.cs b/src/Security/Authentication/test/CookieTests.cs index 766d1e2e5389..c2445d747cb3 100644 --- a/src/Security/Authentication/test/CookieTests.cs +++ b/src/Security/Authentication/test/CookieTests.cs @@ -649,7 +649,7 @@ public async Task CookieOptionsAlterSetCookieHeader() Assert.Contains(" path=/foo", setCookie1); Assert.Contains(" domain=another.com", setCookie1); Assert.Contains(" secure", setCookie1); - Assert.DoesNotContain(" samesite", setCookie1); + Assert.Contains(" samesite=none", setCookie1); Assert.Contains(" httponly", setCookie1); var server2 = CreateServer(o => diff --git a/src/Security/Authentication/test/Microsoft.AspNetCore.Authentication.Test.csproj b/src/Security/Authentication/test/Microsoft.AspNetCore.Authentication.Test.csproj index d008f35ffd55..94e3ae739d7a 100644 --- a/src/Security/Authentication/test/Microsoft.AspNetCore.Authentication.Test.csproj +++ b/src/Security/Authentication/test/Microsoft.AspNetCore.Authentication.Test.csproj @@ -1,4 +1,4 @@ - + netcoreapp2.1;net461 @@ -39,6 +39,7 @@ + diff --git a/src/Security/Authentication/test/OpenIdConnect/OpenIdConnectChallengeTests.cs b/src/Security/Authentication/test/OpenIdConnect/OpenIdConnectChallengeTests.cs index cbafc46223b8..9e2c47a7a7ba 100644 --- a/src/Security/Authentication/test/OpenIdConnect/OpenIdConnectChallengeTests.cs +++ b/src/Security/Authentication/test/OpenIdConnect/OpenIdConnectChallengeTests.cs @@ -376,6 +376,7 @@ public async Task ChallengeSetsNonceAndStateCookies(OpenIdConnectRedirectBehavio var server = settings.CreateTestServer(); var transaction = await server.SendAsync(ChallengeEndpoint); + Assert.Contains("samesite=none", transaction.SetCookie.First()); var challengeCookies = SetCookieHeaderValue.ParseList(transaction.SetCookie); var nonceCookie = challengeCookies.Where(cookie => cookie.Name.StartsWith(OpenIdConnectDefaults.CookieNoncePrefix, StringComparison.Ordinal)).Single(); Assert.True(nonceCookie.Expires.HasValue); @@ -613,4 +614,4 @@ public async Task Challenge_HasOverwrittenMaxAgeParaFromBaseAuthenticationProper Assert.Contains("max_age=1234", res.Headers.Location.Query); } } -} \ No newline at end of file +} diff --git a/src/Security/CookiePolicy/src/CookiePolicyOptions.cs b/src/Security/CookiePolicy/src/CookiePolicyOptions.cs index 32d047297ac5..dda970a511f1 100644 --- a/src/Security/CookiePolicy/src/CookiePolicyOptions.cs +++ b/src/Security/CookiePolicy/src/CookiePolicyOptions.cs @@ -12,6 +12,18 @@ namespace Microsoft.AspNetCore.Builder /// public class CookiePolicyOptions { + // True (old): https://tools.ietf.org/html/draft-west-first-party-cookies-07#section-3.1 + // False (new): https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-03#section-4.1.1 + internal static bool SuppressSameSiteNone; + + static CookiePolicyOptions() + { + if (AppContext.TryGetSwitch("Microsoft.AspNetCore.SuppressSameSiteNone", out var enabled)) + { + SuppressSameSiteNone = enabled; + } + } + /// /// Affects the cookie's same site attribute. /// @@ -49,4 +61,4 @@ public class CookiePolicyOptions /// public Action OnDeleteCookie { get; set; } } -} \ No newline at end of file +} diff --git a/src/Security/CookiePolicy/src/ResponseCookiesWrapper.cs b/src/Security/CookiePolicy/src/ResponseCookiesWrapper.cs index 126c4d7bd525..1db77125f664 100644 --- a/src/Security/CookiePolicy/src/ResponseCookiesWrapper.cs +++ b/src/Security/CookiePolicy/src/ResponseCookiesWrapper.cs @@ -1,4 +1,4 @@ -// Copyright (c) .NET Foundation. All rights reserved. +// Copyright (c) .NET Foundation. All rights reserved. // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. using System; @@ -115,7 +115,8 @@ public string CreateConsentCookie() private bool CheckPolicyRequired() { return !CanTrack - || Options.MinimumSameSitePolicy != SameSiteMode.None + || (CookiePolicyOptions.SuppressSameSiteNone && Options.MinimumSameSitePolicy != SameSiteMode.None) + || (!CookiePolicyOptions.SuppressSameSiteNone && Options.MinimumSameSitePolicy != (SameSiteMode)(-1)) || Options.HttpOnly != HttpOnlyPolicy.None || Options.Secure != CookieSecurePolicy.None; } @@ -241,26 +242,10 @@ private void ApplyPolicy(string key, CookieOptions options) default: throw new InvalidOperationException(); } - switch (Options.MinimumSameSitePolicy) + if (options.SameSite < Options.MinimumSameSitePolicy) { - case SameSiteMode.None: - break; - case SameSiteMode.Lax: - if (options.SameSite == SameSiteMode.None) - { - options.SameSite = SameSiteMode.Lax; - _logger.CookieSameSiteUpgraded(key, "lax"); - } - break; - case SameSiteMode.Strict: - if (options.SameSite != SameSiteMode.Strict) - { - options.SameSite = SameSiteMode.Strict; - _logger.CookieSameSiteUpgraded(key, "strict"); - } - break; - default: - throw new InvalidOperationException($"Unrecognized {nameof(SameSiteMode)} value {Options.MinimumSameSitePolicy.ToString()}"); + options.SameSite = Options.MinimumSameSitePolicy; + _logger.CookieSameSiteUpgraded(key, Options.MinimumSameSitePolicy.ToString()); } switch (Options.HttpOnly) { @@ -278,4 +263,4 @@ private void ApplyPolicy(string key, CookieOptions options) } } } -} \ No newline at end of file +} diff --git a/src/Security/CookiePolicy/test/CookiePolicyTests.cs b/src/Security/CookiePolicy/test/CookiePolicyTests.cs index a2592e55759b..2eec9e7b6c61 100644 --- a/src/Security/CookiePolicy/test/CookiePolicyTests.cs +++ b/src/Security/CookiePolicy/test/CookiePolicyTests.cs @@ -43,6 +43,7 @@ public class CookiePolicyTests context.Response.Cookies.Append("C", "C", new CookieOptions()); context.Response.Cookies.Append("D", "D", new CookieOptions { SameSite = Http.SameSiteMode.Lax }); context.Response.Cookies.Append("E", "E", new CookieOptions { SameSite = Http.SameSiteMode.Strict }); + context.Response.Cookies.Append("F", "F", new CookieOptions { SameSite = (Http.SameSiteMode)(-1) }); return Task.FromResult(0); }; @@ -198,7 +199,7 @@ public async Task SameSiteLaxSetsItAlways() } [Fact] - public async Task SameSiteNoneLeavesItAlone() + public async Task SameSiteNoneSetsItAlways() { await RunTest("/sameSiteNone", new CookiePolicyOptions @@ -208,13 +209,36 @@ public async Task SameSiteNoneLeavesItAlone() SameSiteCookieAppends, new RequestTest("http://example.com/sameSiteNone", transaction => + { + Assert.NotNull(transaction.SetCookie); + Assert.Equal("A=A; path=/; samesite=lax", transaction.SetCookie[0]); + Assert.Equal("B=B; path=/; samesite=none", transaction.SetCookie[1]); + Assert.Equal("C=C; path=/; samesite=lax", transaction.SetCookie[2]); + Assert.Equal("D=D; path=/; samesite=lax", transaction.SetCookie[3]); + Assert.Equal("E=E; path=/; samesite=strict", transaction.SetCookie[4]); + Assert.Equal("F=F; path=/; samesite=none", transaction.SetCookie[5]); + })); + } + + [Fact] + public async Task SameSiteUnspecifiedLeavesItAlone() + { + await RunTest("/sameSiteNone", + new CookiePolicyOptions + { + MinimumSameSitePolicy = (Http.SameSiteMode)(-1) + }, + SameSiteCookieAppends, + new RequestTest("http://example.com/sameSiteNone", + transaction => { Assert.NotNull(transaction.SetCookie); Assert.Equal("A=A; path=/", transaction.SetCookie[0]); - Assert.Equal("B=B; path=/", transaction.SetCookie[1]); + Assert.Equal("B=B; path=/; samesite=none", transaction.SetCookie[1]); Assert.Equal("C=C; path=/; samesite=lax", transaction.SetCookie[2]); Assert.Equal("D=D; path=/; samesite=lax", transaction.SetCookie[3]); Assert.Equal("E=E; path=/; samesite=strict", transaction.SetCookie[4]); + Assert.Equal("F=F; path=/", transaction.SetCookie[5]); })); } @@ -468,4 +492,4 @@ public async Task Execute(TestServer server) } } } -} \ No newline at end of file +} diff --git a/src/Security/CookiePolicy/test/Microsoft.AspNetCore.CookiePolicy.Test.csproj b/src/Security/CookiePolicy/test/Microsoft.AspNetCore.CookiePolicy.Test.csproj index cf7016dd3d1f..6d4c6c8535ac 100644 --- a/src/Security/CookiePolicy/test/Microsoft.AspNetCore.CookiePolicy.Test.csproj +++ b/src/Security/CookiePolicy/test/Microsoft.AspNetCore.CookiePolicy.Test.csproj @@ -1,4 +1,4 @@ - + netcoreapp2.1;net461 @@ -13,6 +13,7 @@ + diff --git a/src/Security/Security.sln b/src/Security/Security.sln index 3d36597db9d3..557b68ac83a0 100644 --- a/src/Security/Security.sln +++ b/src/Security/Security.sln @@ -102,6 +102,8 @@ Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Microsoft.AspNetCore.Server EndProject Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Microsoft.AspNetCore.Server.IISIntegration", "..\Servers\IIS\IISIntegration\src\Microsoft.AspNetCore.Server.IISIntegration.csproj", "{81D0E81F-4711-4C7B-BBD4-E168102D0D7D}" EndProject +Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Microsoft.Net.Http.Headers", "..\Http\Headers\src\Microsoft.Net.Http.Headers.csproj", "{4BB8D7D7-E111-4A86-B6E5-C1201E0DA8CE}" +EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|Any CPU = Debug|Any CPU @@ -248,6 +250,10 @@ Global {81D0E81F-4711-4C7B-BBD4-E168102D0D7D}.Debug|Any CPU.Build.0 = Debug|Any CPU {81D0E81F-4711-4C7B-BBD4-E168102D0D7D}.Release|Any CPU.ActiveCfg = Release|Any CPU {81D0E81F-4711-4C7B-BBD4-E168102D0D7D}.Release|Any CPU.Build.0 = Release|Any CPU + {4BB8D7D7-E111-4A86-B6E5-C1201E0DA8CE}.Debug|Any CPU.ActiveCfg = Debug|Any CPU + {4BB8D7D7-E111-4A86-B6E5-C1201E0DA8CE}.Debug|Any CPU.Build.0 = Debug|Any CPU + {4BB8D7D7-E111-4A86-B6E5-C1201E0DA8CE}.Release|Any CPU.ActiveCfg = Release|Any CPU + {4BB8D7D7-E111-4A86-B6E5-C1201E0DA8CE}.Release|Any CPU.Build.0 = Release|Any CPU EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE @@ -298,6 +304,7 @@ Global {707CBFB4-4D35-479E-9BAF-39B4DA9782DE} = {A3766414-EB5C-40F7-B031-121804ED5D0A} {AFE880E8-2E9E-46FD-BE87-DFC8192E7B2D} = {A3766414-EB5C-40F7-B031-121804ED5D0A} {81D0E81F-4711-4C7B-BBD4-E168102D0D7D} = {A3766414-EB5C-40F7-B031-121804ED5D0A} + {4BB8D7D7-E111-4A86-B6E5-C1201E0DA8CE} = {A3766414-EB5C-40F7-B031-121804ED5D0A} EndGlobalSection GlobalSection(ExtensibilityGlobals) = postSolution SolutionGuid = {ABF8089E-43D0-4010-84A7-7A9DCFE49357}