title: Preventing CSRF with the same-site cookie attribute
body: <p>I was surfing the web and found article <a href="https://www.sjoerdlangkemper.nl/2016/04/14/preventing-csrf-with-samesite-cookie-attribute/" rel="noreferrer">Preventing CSRF with the same-site cookie attribute</a>.</p>
  
  <p>As on link maintain We need to add Set-Cookie header.</p>
  
  <blockquote>
    <p>Set-Cookie: key=value; HttpOnly; SameSite=strict</p>
  </blockquote>
  
  <p>Now My Question is, I want to set this in my ASP.NET site in all Cookies and Authentication Cookie. 
  I tried to set this using header from IIS but someone says this is wrong way implementation.</p>
  
  <p>I have also tried below.</p>
  
  <pre><code>HttpCookie newAuthenticationCookie = new HttpCookie(FormsAuthentication.FormsCookieName
                      , FormsAuthentication.Encrypt(newAuthenticationTicket))
                  {
                      HttpOnly = true
                  };
  newAuthenticationCookie.Values.Add("SameSite", "strict");
  </code></pre>
  
  <p>But it seems like not helping me.</p>
  
  <p>Please suggest me a better way to do this.</p>
  
  <p>Thanks.</p>