title: Setting SameSite=None and Secure in ASP.NET
body: <p>Read about the <code>SameSite</code> changes enforced to prevent Cross-Site Forgery.
  Source: <a href="https://blog.chromium.org/2019/10/developers-get-ready-for-new.html" rel="nofollow noreferrer">https://blog.chromium.org/2019/10/developers-get-ready-for-new.html</a></p>
  
  <p>I'm trying to set its value to "None" and use <code>Secure</code> as advertised.</p>
  
  <p>My current <code>web.config</code> setting is as below:</p>
  
  <pre><code>&lt;system.web&gt;
      &lt;sessionState cookieless="UseCookies" 
         timeout="20" 
         cookieSameSite="None" 
         xdt:Transform="Replace" 
         xdt:Locator="Match(cookieless)"/&gt;
    &lt;/system.web&gt;
  </code></pre>
  
  <p>Documentation Soure: 
  <a href="https://docs.microsoft.com/en-us/dotnet/api/system.web.configuration.sessionstatesection.cookiesamesite?view=netframework-4.8#System_Web_Configuration_SessionStateSection_CookieSameSite" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/dotnet/api/system.web.configuration.sessionstatesection.cookiesamesite?view=netframework-4.8#System_Web_Configuration_SessionStateSection_CookieSameSite</a></p>
  
  <p>But still I get the below error:</p>
  
  <pre><code>A cookie associated with a resource at `mywebsite.net` was set with `SameSite=None` but without `Secure`. A future release of Chrome will only deliver cookies marked `SameSite=None` if they are also marked `Secure`.
  </code></pre>
  
  <p>How do I specify <code>secure</code> attribute in the above web.config file ? Any leads will be much appreciated.</p>