如何为4.7.2（对于4.5.2）的.Net Framework设置cookie属性Samesite = None [英] How to set cookie attribute Samesite = None for .Net Framework earlier of 4.7.2 (for 4.5.2)

问题描述

根据Google Chrome的最新更新，它仅允许具有属性的跨平台Cookie

As per the recent update from Google Chrome, it only allows cross-platform cookies which having attribute

sameSite=None

链接： https://docs.microsoft。 com / en-us / aspnet / samesite / system-web-samesite＃net-versions-earlier-than-472

根据上述图片，Microsoft不会为低于4.7.2的较低版本提供此属性的内置支持。

As per the above image, Microsoft doesn't provide build-in support of this Attribute for lower version then 4.7.2.

因此，我们无法在服务器端创建cookie时对其进行设置。

So, we are unable to set it while creating cookie at server side.

是否可以使用SameSite属性创建cookie？

Is there any possible way we can create cookie with SameSite Attribute?

推荐答案

UPDATE：

假设您已安装IIS的URL Rewrite Extension 2.0 ed（Azure App Services， nee Azure网站，已经安装了此程序）然后，您应该查看@sreenath的答案，因为该解决方案应适用于大多数用户。

UPDATE:

Assuming you have IIS' URL Rewrite Extension 2.0 installed (Azure App Services, nee Azure Websites, have this installed already) then you should look at @sreenath's answer as that solution should work for most users.

但是（处于我的特权位置，位于我巨大的自我泡沫内的象牙塔中）没有理由不使用.NET Framework 4.7.2或更高版本的任何项目，因为过去5年以上（Visual Studio 2013及更高版本）的.NET Framework更新在很大程度上是可加和向后兼容的。 因此，我强烈建议开发人员首先（尝试）将其项目更新到.NET Framework 4.7.2或4.8 ，然后再尝试使用IIS Rewrite等黑客方法来设置 SameSite cookie参数。

However (in my privileged position from within my ivory tower inside a giant egotistical bubble) there is no excuse for any project not already using .NET Framework 4.7.2 or later because the .NET Framework updates over the past 5+ years (Visual Studio 2013, onwards) have been largely additive and backwards-compatible. So I strongly urge developers to (try to) update their projects to .NET Framework 4.7.2 or 4.8 first before trying hacks like using IIS Rewrite to set the SameSite cookie parameter.

如何设置cookie属性Samesite = None。 Net Framework早于4.7.2（适用于4.5.2）

How to set cookie attribute Samesite = None for .Net Framework earlier of 4.7.2 (for 4.5.2)

简单地说：您不能。

您在此发表的文章链接到解释了为什么（强调我的意思）：

The article you linked to explains why (emphasis mine):

Microsoft不支持低于4.7.2的.NET版本用于编写同一站点的cookie属性。我们未没有找到一种可靠的方法：

Microsoft does not support .NET versions lower that 4.7.2 for writing the same-site cookie attribute. We have not found a reliable way to:

• 确保根据浏览器版本正确编写属性。


• 在较旧的框架版本上拦截并调整身份验证和会话cookie

唯一的解决方案是升级您的项目到.NET Framework 4.7.2或更高版本。

The only solution is to upgrade your project to .NET Framework 4.7.2 or later.

但是，好消息是，从.NET Framework 4.5升级到4.7.2的过程很容易，而且向后兼容性极低（如果有）问题。您甚至不必更改 web.config 文件中的任何内容（即，仍可以将ASP.NET WebForms 4.5与.NET Framework 4.8一起使用）。

But the good news is that upgrading from .NET Framework 4.5 to 4.7.2 is easy with minimal, if any, backwards-compatibility issues. You don't even have to change anything in your web.config file (i.e. you can still use ASP.NET WebForms 4.5 with .NET Framework 4.8).

所有您需要做的是：

1. 进行新的git commit。


2. 打开您在记事本中的 .csproj 文件。


3. 更改< TargetFrameworkVersion> v4.5.2< / TargetFrameworkVersion> 到< TargetFrameworkVersion> v4.7.2< / TargetFrameworkVersion>


4. 保存。


5. 在Visual Studio中重新打开项目/解决方案，然后单击重建。

1. Make a new git commit.
2. Open your .csproj files in Notepad.
3. Change <TargetFrameworkVersion>v4.5.2</TargetFrameworkVersion> to <TargetFrameworkVersion>v4.7.2</TargetFrameworkVersion>
4. Save.
5. Reopen your projects/solutions in Visual Studio and click rebuild.

您遇到的唯一问题是经验是：

The only problems you'll run-into, in my experience, is:

• 需要刷新/重新安装NuGet软件包，因为NuGet确实不能轻松处理目标框架更改。修复起来很简单（只需删除 packages 目录）。


• Non-NuGet依赖项（例如老式的WinForms组件，ew ）具有特殊的安装步骤，由于某些原因，这些安装步骤与特定的.NET Framework版本有很强的依赖性-在这种情况下，如果您的组件供应商没有更新，我会感到非常惊讶。

• Needing to refresh/reinstall NuGet packages, as NuGet really doesn't handle target-framework changes easily. This is straightforward to fix (just nuke your packages directory).
• Non-NuGet dependencies (like old-school WinForms components, ew) that have special installation steps that for some reason have a hard dependency on a specific .NET Framework version - in which case I'll be very surprised if your component vendor doesn't have an update.

当然，我仍然会责备您的产品经理，因为他们不能确保他们的项目保持正常运作状态七年 （.NET Framework 4.5.2于2013年发布）。为什么没有配置CI管道来自动处理此问题？

Of course, I'll still chide your product's managers for not ensuring that their project is kept in working-order for seven years (As .NET Framework 4.5.2 was released in 2013). Why isn't there a CI pipeline set-up to handle this automatically?

这篇关于如何为4.7.2（对于4.5.2）的.Net Framework设置cookie属性Samesite = None的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！