如何使用 C# ASP.Net Core 3.1 在服务器端检查 cookie 选项

Question

I'm creating a cookie with the following options:

var cookieOptions = new CookieOptions
{
    HttpOnly = true,
    SameSite = SameSiteMode.Strict,
    Secure = true
};
Response.Cookies.Append("myCookie", customerToken, cookieOptions);

I would love to validate when I get the cookie back from the browser that it's still created with httponly, samesite and secure before accepting it. Or is this just silly, can all of those be faked in the browser?

Answer 1

As you mentioned to validate, above should be the part of authorization. You can do it by use policy based Authorization where you can define policy's terms and conditions to be meant before executing any action.

How to guide: https://docs.microsoft.com/en-us/aspnet/core/security/authorization/policies?view=aspnetcore-3.1#apply-policies-to-mvc-controllers

First you read the cookie data from request. and can use attribute authorization like: [Authorize(Policy = "your policy name ")] at endpoints/controller level

after that implement handler like: Auth Handler where you define your above mentioned conditions. It will fail the authorization if the token/cookie is not as per your conditions in handler.

Answer 2

Based on the feedback so far, it looks like that information is not accessible, it is not even sent from the client to the server, only key/value pairs. That being said, even if it was accessible, it can be manipulated by the browser which invalidates my use case to begin with!