如何在 ASP.NET Core Web API 项目中设置 cookie

Question

I'm attempting to set a cookie for my ASP.NET Core Web API project in localhost, but the cookie only gets sent through the response header and not set in the browser. I have tried setting

withcredentials: true

in the cookie, but that did not work.

Here is the code of the controller:

string token = "Some string";
var cookieOptions = new CookieOptions()
    {
        IsEssential = true,
        Expires = DateTime.Now.AddMinutes(30),
        Secure = true,
        HttpOnly = true,
        SameSite = SameSiteMode.None
    };

Response.Cookies.Append("XSRF_Auth", token, cookieOptions);

Here is a snippet of the network information for that response:

Response Information

Also, my program.cs file looks like this:

var configuration = new ConfigurationBuilder().AddJsonFile("appsettings.json").Build();
string[] origins = {"https://localhost:4200"};

builder.Services.AddCors();

builder.Services.AddControllers();

builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();

var app = builder.Build();

if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}

app.UseCors(x => x.AllowAnyHeader().AllowAnyMethod().WithOrigins(origins));

app.UseHttpsRedirection();
app.UseAuthentication();
app.UseAuthorization();

app.MapControllers();

app.Run();

I'm not receiving any errors and the cookie fails to get set in all browsers. I'm using a self-signed certificate for ssl and I'm using .NET Core 6.0. I usually never had issues in previous versions of .NET Core, but this issue is very odd to me.

Answer 1

当您设置HttpOnly = true时，cookie 仅出现在请求标头中，客户端脚本无法访问。