question

Jorisbinkies-5725 avatar image
0 Votes"
Jorisbinkies-5725 asked ·

Samesite cookie patch still not rolled out on Azure App Service

According to this, the samesite cookie patch should have been rolled out months ago. My Azure App Service is still running v87.0.7.74 which is less than the version being talked about in the article. How/when is my instance going to get updated because my users are starting to run into this cookie issue.

azure-webapps
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

ryanchill avatar image
0 Votes"
ryanchill answered ·

Hi @Jorisbinkies-5725, the Samesite cooking patch was part of a patch that applies to app service version 86.0.7.148 and later. Your version is 87.0.7.74, so it includes the Samesite patch. Are you using SameSite=none on your app? Is it all your users or a subset? If a subset, is there anything common amongst all of them?

You can also view https://docs.microsoft.com/answers/questions/6842/announcement-samesite-cookie-handling-and-net-fram.html for additional information about the patch.

· 1 · Share
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Ow damn, I missed the major version number being different, sigh. Well in that case I dont understand why it is still not working, I updated my project to .net 4.7.2, updated all libraries (asp.net etc) to the latest versions. I've put samesite=none in my web.config, but even with an outbound rule that adds it to every cookie it is still not outputting the samesite attribute on the asp.net applicationcookie (even though it is doing it on every other cookie).

0 Votes 0 · ·