title: Antiforgery token not set in the cookie when deployed in azure
body: <p>I have two app services, one is an angular app and the other is a .NET core 2.0 app. I create Antiforgery token from the latter and attach to a header for each request, so that it is set as a cookie in the former.</p>
  
  <p>Startup.cs</p>
  
  <pre><code>    public void ConfigureServices(IServiceCollection services)
      {
          services.AddCors();
          services.AddAntiforgery(options =&gt;
          {
              options.HeaderName = "X-XSRF-TOKEN";
              options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
              options.Cookie.HttpOnly = false;
              options.Cookie.SameSite = SameSiteMode.None;
  
          });
          ...
  
      public void Configure(IApplicationBuilder app, IHostingEnvironment env)
      {
          app.UseCookiePolicy(new CookiePolicyOptions
          {
              MinimumSameSitePolicy = SameSiteMode.None
          });
  
          app.UseAntiforgeryTokenMiddleware("X-XSRF-TOKEN");
          ....
  </code></pre>
  
  <p>AntiForgeryMiddleware.cs</p>
  
  <pre><code>    public async Task Invoke(HttpContext context, IAntiforgery antiforgery, ILogger&lt;AntiForgeryMiddleware&gt; logger)
      {
          string path = context.Request.Path.Value;
          if (path != null &amp;&amp; path.ToLower().Contains("/api/account/authorizeview"))
          {
              if (httpVerbs.Contains(context.Request.Method, StringComparer.OrdinalIgnoreCase))
              {
                  var tokens = antiforgery.GetAndStoreTokens(context);
  
                  context.Response.Cookies.Append(requestTokenCookieName, tokens.RequestToken, new CookieOptions()
                  {
                      HttpOnly = false, 
                      Secure = true
                  });
              } 
          }
          context.Response.Headers.Add("Access-Control-Allow-Credentials", "true");
  
          await next.Invoke(context);
      }
  </code></pre>
  
  <p>In Angular app <code>withCredentials: true</code> is set.
  This works in localhost but when deployed to azure cookies are not set in Chrome. In Microsoft Edge, cookies are displayed as the screenshot in the response but not in application storage.</p>
  
  <p><a href="https://i.stack.imgur.com/mbD9R.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/mbD9R.png" alt="enter image description here"></a></p>