How to mark the cookie from AAD B2C to be secure?

Carol Lai 521

Our app service uses custom policy to log in through AAD B2C and receive the authentication from it. Since it's a cross-site cookie, we need to mark it SameSite=None with the Secure attribute,

I read that AAD B2C supports this attribute based on the following document.
https://learn.microsoft.com/en-us/azure/active-directory-b2c/cookie-definitions

How to configure this cookie from AAD B2C with the secure attribute?

singhh-msft 2,431 Reputation points

2021-09-24T11:10:05.143+00:00

@CaroLai-5934, thank you for reaching out to us. Here is Handle SameSite cookie changes in Chrome browser and here are some samples to help you. Let me know if this works for you.
Carol Lai 521 Reputation points

2021-09-24T14:52:56.793+00:00

I followed this link you provided to modify my startup.cs.
https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/pull/261

The cookie from AAD B2C still doesn't have a secure flag set for cookie.

singhh-msft 2,431

@Carol Lai , thanks for this information. Pls have a look at Enable authentication in your own web app by using Azure AD B2C and replace the ConfigureServices(IServiceCollection services) function with the following code snippet:

public void ConfigureServices(IServiceCollection services)  
{  
    services.Configure<CookiePolicyOptions>(options =>  
    {  
        // This lambda determines whether user consent for non-essential cookies is needed for a given request.  
        options.CheckConsentNeeded = context => true;  
        options.MinimumSameSitePolicy = SameSiteMode.Unspecified;  
        // Handling SameSite cookie according to https://learn.microsoft.com/en-us/aspnet/core/security/samesite?view=aspnetcore-3.1  
        options.HandleSameSiteCookieCompatibility();  
    });  
  
    // Configuration to sign-in users with Azure AD B2C  
    services.AddMicrosoftIdentityWebAppAuthentication(Configuration, "AzureAdB2C");  
  
    services.AddControllersWithViews()  
        .AddMicrosoftIdentityUI();  
  
    services.AddRazorPages();  
  
    //Configuring appsettings section AzureAdB2C, into IOptions  
    services.AddOptions();  
    services.Configure<OpenIdConnectOptions>(Configuration.GetSection("AzureAdB2C"));

Replace the Configure function with the following code snippet:

    app.UseCookiePolicy();

Let me know if you have any follow-up questions.

Carol Lai 521 Reputation points

2021-09-28T17:27:25.78+00:00

@singhh-msft

Our code doesn't produce the cookie. The user logs in AAD B2C by using the custom police. When the user accesses our site, it gets routed to b2clogin.com. Upon a successful login, b2clogin.com reroutes back to our site with a cookie without Secure attribute.

How to configure AAD B2C to return a cookie with Secure attribute? Are you suggesting to catch the response from AAD B2C and add the cookieOptions? What event handler in Authentication.OpenIdConnect can catch that? Do you have a sample code?
singhh-msft 2,431 Reputation points

2021-09-29T05:05:02.453+00:00

@Carol Lai , pls check my updated response.

Accepted answer

Loki Mutua 76 Reputation points

2021-09-28T12:29:23.71+00:00

@Carol Lai

Could you add this snippet in your startup.cs file under cookie options configuration and let me know if this fixes the issue.

options.Secure = CookieSecurePolicy.Always;
Please sign in to rate this answer.
Carol Lai 521 Reputation points

2021-09-28T14:20:47.92+00:00

Here are the codes I have tried. Nothing adds the Secure attribute to the cookie from AAD B2C.

options.MinimumSameSitePolicy = SameSiteMode.None;
options.HandleSameSiteCookieCompatibility();
options.Secure = CookieSecurePolicy.Always;

options.MinimumSameSitePolicy = SameSiteMode.Unspecified;
options.HandleSameSiteCookieCompatibility();
options.Secure = CookieSecurePolicy.Always;

options.MinimumSameSitePolicy = SameSiteMode.Unspecified;
options.HandleSameSiteCookieCompatibility();

Loki Mutua 76 Reputation points

2021-09-29T07:25:21.437+00:00

@Carol Lai

All Azure AD B2C cookies are carrying the SameSite, Secure, HttpOnly flags:

These flags means that the cookies from B2C are only available to the browser when sent over secure SSL Channel / HTTPS (secure) and are only available to the browsers, but not to JavaScript / Client code (HttpOnly) and are allowed by modern browsers (SameSite: none) as valid third party cookies.

So, as for Azure AD B2C as a service is fully compliant with all listed cookie options.

From B2C side, you cannot add any more cookies. These are are service cookies automatically handled by B2C.
Sign in to comment

How to mark the cookie from AAD B2C to be secure?

0 additional answers