title: Cookie not being set in iframe
body: <p>I have an Identity Server (v4) on one server and a web application on a different server &amp; domain. I only need windows authentication, and everything works fine with a redirect. However, I noticed that silent sign-in works if the cookie hasn't yet expired. </p>
  
  <p>If the cookie has expired, a redirect is currently necessary which works fine. Unfortunately however, this would mean if there's data the user hasnt saved on the current screen they will loose it unless I implement a caching mechanism. Instead, I want to set a hidden iframe that simply navigates to the Identity Server, auto logs in if the user is inside the company infrastructure (which they always will be).</p>
  
  <p>After hours of debugging I have found that while cookies are correctly sent from the iFrame, any that are SET don't seem to work - they are in chrome debugger as a response cookie, but are not sent along on the next redirect as request cookies and I dont know why.</p>
  
  <p>On response:</p>
  
  <blockquote>
    <p><strong>Cookie Options</strong>: SameSite Lax, HTTP true, Secure true, Path /</p>
    
    <p>Headers:</p>
    
    <p><strong>Content-Security-Policy</strong>: default-src 'self'; object-src 'none'; frame-src localhost:44388; frame-ancestors 'self'
    <a href="https://localhost:44388/" rel="noreferrer">https://localhost:44388/</a>; sandbox allow-forms allow-same-origin
    allow-scripts; base-uri 'self';</p>
    
    <p><strong>Persistent-Auth</strong>: true</p>
    
    <p><strong>Pragma</strong>: no-cache</p>
    
    <p><strong>Referrer-Policy</strong>: no-referrer</p>
    
    <p><strong>WWW-Authenticate</strong>: Negotiate oRswGaADCgEAoxIEEAEAAABJ+0p/zH0aeAAAAAA=</p>
    
    <p><strong>X-Content-Security-Policy</strong>: default-src 'self'; object-src 'none'; frame-src 
    **localhost:44388; frame-ancestors 'self' <a href="https://localhost:44388/" rel="noreferrer">https://localhost:44388/</a>; sandbox allow-forms allow-same-origin allow-scripts; base-uri 'self';</p>
    
    <p><strong>X-Content-Type-Options</strong>: nosniff</p>
    
    <p><strong>X-Frame-Options</strong>: ALLOW-FROM <a href="https://localhost:44388/" rel="noreferrer">https://localhost:44388/</a></p>
  </blockquote>