As part of the January 2020 update to Azure App Service, .NET Framework patches that address SameSite cookie handling and the .NET Framework 4.7.2 patch are now available for all Azure App Service plans.
What is SameSite?
The SameSite cookie attribute is a security mechanism that restricts how cookies are sent with cross-site requests. It helps prevent cross-site request forgery (CSRF) attacks and cross-site information leakage.
Google Chrome 80 changed the default SameSite behaviour for cookies without an explicit SameSite attribute, treating them as SameSite=Lax instead of SameSite=None. This change can break applications that rely on cross-site cookie access.
Impact on Azure App Service Applications
Applications hosted on Azure App Service that use session cookies, authentication cookies, or other cookies that need to work in cross-site scenarios may be affected by Chrome 80's SameSite changes. Common affected scenarios include:
- OpenID Connect and OAuth 2.0 authentication flows
- iFrame-embedded applications
- Third-party integrations that use cookies
- Single Sign-On (SSO) implementations
The .NET Framework Patches
Microsoft has released patches for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.7, 4.7.1, 4.7.2, and 4.8 that add support for the new SameSite=None attribute value. These patches have been applied to all Azure App Service instances.
What You Need to Do
- Review your application's cookie usage: Identify cookies that are used in cross-site scenarios.
- Update your code: Explicitly set
SameSite=None; Secureon cookies that need to work cross-site. - Test in Chrome 80+: Test your application in a browser that implements the new SameSite behaviour.
- Handle older browsers: Some older browsers (iOS 12, Chrome 51-66) have bugs with the new
SameSite=Nonevalue; implement user-agent detection if needed.
Security updates to cookie handling are a reminder that web application security requires ongoing vigilance. TechJordan recommends scheduling regular security reviews of your Azure-hosted applications.