title: .NET5 blazor server & Azure B2C auth - signin ok on localhost, but fails on Azure App Service - cookie 'SameSite=None' must also set 'Secure'?
body: <p>I have configured my .NET5 blazor server app to use Azure B2C for authentication, and it works fine on localhost when I set https://localhost:5000/signin-oidc as a redirect URI, but when I switch it to use my public domain and then publish the website to Azure I get this in the log on the server, and the browser renders a 500 trying to redirect to /MicrosoftIdentity/Account/Error</p>
  <pre><code>2021-03-18T00:30:59.069927572Z [00:30:59 WRN] The cookie '.AspNetCore.OpenIdConnect.Nonce.CfDJ8I_wgoDb1d1Kh7HcYY9-b0zqUwrvd-eBMsOMBS0O9MSIwSHKuDhE2EHY_srrCjT3463463463467HU2JZ1CrnpbbOKG3DYh978UWlVpztUe55CfUzr0mmaL5__drc-v8IU-aWwTCIjISYv9X68YgBSpa41ilw8DEUPEFvA' has set 'SameSite=None' and must also set 'Secure'.
  2021-03-18T00:30:59.090919125Z [00:30:59 WRN] The cookie '.AspNetCore.Correlation.n4oDOu_6H3G58xPPXaJ0dYv56G6wek5S5DE6_TdbGeg' has set 'SameSite=None' and must also set 'Secure'.
  2021-03-18T00:30:59.124097767Z [00:30:59 INF] AuthenticationScheme: OpenIdConnect was challenged.
  2021-03-18T00:30:59.135738852Z [00:30:59 INF] Executed action Microsoft.Identity.Web.UI.Areas.MicrosoftIdentity.Controllers.AccountController.SignIn (Microsoft.Identity.Web.UI) in 2025.9109ms
  2021-03-18T00:30:59.141185892Z [00:30:59 INF] Executed endpoint 'Microsoft.Identity.Web.UI.Areas.MicrosoftIdentity.Controllers.AccountController.SignIn (Microsoft.Identity.Web.UI)'
  2021-03-18T00:30:59.144883119Z [00:30:59 INF] Request finished HTTP/1.1 GET http://studio.mydomain.com/MicrosoftIdentity/Account/SignIn - - - 302 0 - 2110.6962ms
  2021-03-18T00:31:02.961972761Z [00:31:02 INF] Request starting HTTP/1.1 POST http://studio.mydomain.com/signin-oidc application/x-www-form-urlencoded 655
  2021-03-18T00:31:03.032778677Z [00:31:03 WRN] '.AspNetCore.Correlation.n4oDOu_6H343563463463wek5S5DE6_TdbGeg' cookie not found.
  2021-03-18T00:31:03.033681584Z [00:31:03 INF] Error from RemoteAuthentication: Correlation failed..
  2021-03-18T00:31:03.050863209Z [00:31:03 INF] Request finished HTTP/1.1 POST http://studio.mydomain.com/signin-oidc application/x-www-form-urlencoded 655 - 302 0 - 74.3430ms
  2021-03-18T00:31:03.126354159Z [00:31:03 INF] Request starting HTTP/1.1 GET http://studio.mydomain.com/MicrosoftIdentity/Account/Error - -
  2021-03-18T00:31:03.148067518Z [00:31:03 INF] OpenIdConnect was not authenticated. Failure message: Not authenticated
  2021-03-18T00:31:03.149001925Z [00:31:03 INF] Executing endpoint '/Account/Error'
  2021-03-18T00:31:03.159059298Z [00:31:03 INF] Route matched with {page = &quot;/Account/Error&quot;, area = &quot;MicrosoftIdentity&quot;, action = &quot;&quot;, controller = &quot;&quot;}. Executing page /Account/Error
  2021-03-18T00:31:03.166577353Z [00:31:03 INF] Executing handler method Microsoft.Identity.Web.UI.Areas.MicrosoftIdentity.Pages.Account.ErrorModel.OnGet - ModelState is Valid
  2021-03-18T00:31:03.167801962Z [00:31:03 INF] Executed handler method OnGet, returned result .
  2021-03-18T00:31:03.168506467Z [00:31:03 INF] Executing an implicit handler method - ModelState is Valid
  2021-03-18T00:31:03.169229872Z [00:31:03 INF] Executed an implicit handler method, returned result Microsoft.AspNetCore.Mvc.RazorPages.PageResult.
  2021-03-18T00:31:03.318943164Z [00:31:03 INF] Executed page /Account/Error in 159.3968ms
  2021-03-18T00:31:03.320068472Z [00:31:03 INF] Executed endpoint '/Account/Error'
  2021-03-18T00:31:03.465075330Z [00:31:03 ERR] An unhandled exception has occurred while executing the request.
  </code></pre>
  <p>When I compare to localhost logs such as this one, where authentication is successful, there are a few key differences I note:</p>
  <pre><code>20:55:48 INF] Executing endpoint 'Microsoft.Identity.Web.UI.Areas.MicrosoftIdentity.Controllers.AccountController.SignIn (Microsoft.Identity.Web.UI)'
  [20:55:48 INF] Route matched with {area = &quot;MicrosoftIdentity&quot;, action = &quot;SignIn&quot;, controller = &quot;Account&quot;, page = &quot;&quot;}. Executing controller action with signature Microsoft.AspNetCore.Mvc.IActionResult SignIn(System.String) on controller Microsoft.Identity.Web.UI.Areas.MicrosoftIdentity.Controllers.AccountController (Microsoft.Identity.Web.UI).
  [20:55:48 INF] Executing ChallengeResult with authentication schemes ([&quot;OpenIdConnect&quot;]).
  [20:55:48 INF] AuthenticationScheme: OpenIdConnect was challenged.
  [20:55:48 INF] Executed action Microsoft.Identity.Web.UI.Areas.MicrosoftIdentity.Controllers.AccountController.SignIn (Microsoft.Identity.Web.UI) in 77.4856ms
  [20:55:48 INF] Executed endpoint 'Microsoft.Identity.Web.UI.Areas.MicrosoftIdentity.Controllers.AccountController.SignIn (Microsoft.Identity.Web.UI)'
  [20:55:48 INF] Request finished HTTP/2 GET https://localhost:5001/MicrosoftIdentity/Account/SignIn - - - 302 0 - 265.8197ms
  [20:55:54 INF] Executed endpoint '/_blazor'
  [20:55:54 INF] Request finished HTTP/1.1 GET https://localhost:5001/_blazor?id=26iMiwRrnVJr6bgoSUV88A - - - 101 - - 40279.1585ms
  [20:55:55 INF] Request starting HTTP/2 POST https://localhost:5001/signin-oidc application/x-www-form-urlencoded 1578
  [20:55:55 INF] AuthenticationScheme: Cookies signed in.
  [20:55:55 INF] Request finished HTTP/2 POST https://localhost:5001/signin-oidc application/x-www-form-urlencoded 1578 - 302 0 - 365.7586ms
  [20:55:55 INF] Request starting HTTP/2 GET https://localhost:5001/ - -
  </code></pre>
  <p>Localhost is using HTTP/2 and TLS (https) whereas the Azure version is listening http on port 8080 inside its container, so maybe that's a factor?  I have a SSL cert from letsencrypt on the Azure app, so that shouldn't be a factor, and regular https unauthenticated views work just fine.</p>
  <p>In my startup.cs I have this:</p>
  <pre><code>
              services.AddMicrosoftIdentityWebAppAuthentication(Configuration, &quot;AzureAdB2C&quot;);
              services.Configure&lt;CookiePolicyOptions&gt;(options =&gt;
              {
                  options.CheckConsentNeeded = context =&gt; true;
                  options.MinimumSameSitePolicy = SameSiteMode.None;
              });
              services.AddAntiforgery(options =&gt;
              {
                  options.Cookie.SameSite = SameSiteMode.None;
              });
  </code></pre>
  <p>The cookiepolicyoptions and antiforgery stuff was added in an attempt to fix the problem, but so far nothing has been successful, and I think I need advice.  Anyone seen similar? - Thanks</p>