Cookie issue .Net core and Angular web app

Question

Hello everyone, we are reading the cookie at the client-side, (angular js ) and in the server-side we are using an attribute anti-forgery token attribute in controller level (.Net core). In case if I made a cookie as httponly in the sense all POST method API's are failing. Please let me know how to fix this issue or what is the root cause (off course I am aware of if I made httponly true in the sense I cannot read the cookie value in client side) Thanks Madan S B

Kiran Mohanty · Answer

Hey, Can you please try once with below code? public void Configure(IApplicationBuilder app, IHostingEnvironment env) { app.UseCookiePolicy( new CookiePolicyOptions { HttpOnly = HttpOnlyPolicy.Always }); }

gibran aakib · Answer

Hi follow this channel for .NET Core & Angular 11 Tutorials :- https://youtu.be/OL8Ie0Affdg just recently started to explain from scratch to finish

Madan Shekar · Answer

I need to set HttpOnly = true context.Response.Cookies.Append(“XSRF-TOKEN”, tokens.RequestToken, new CookieOptions { HttpOnly = false, Secure = true } After setting HttpOnly =true post methods are not working

Madan Shekar · Answer

can i use that code in .net core startup.cs file ?

Jignesh Kumar · Answer

Hi Madan, I mean you need to do like this, context.Response.Cookies.Append(“XSRF-TOKEN”, tokens.RequestToken, new CookieOptions { HttpOnly = false , Secure = true }

Madan Shekar · Answer

in angular we are using the XSRF-TOKEN

Jignesh Kumar · Answer

Hi Madan, If you are using angular js then you no need to add "XSRF-TOKEN" https://forums.asp.net/t/2134077.aspx?Why+AntiForgeryToken+validation+keeps+failing+

Madan Shekar · Answer

Jignesh i am using same code. the problem is i am setting httponly to true like. context.Response.Cookies.Append("XSRF-TOKEN", tokens.RequestToken, new CookieOptions() { HttpOnly = true});

Jignesh Kumar · Answer

Hi Madan, Please have a look at these links, https://stackoverflow.com/questions/49410813/net-core-api-with-angular-4-the-cookie-token-and-the-request-token-were-swapp https://docs.microsoft.com/en-us/aspnet/core/security/anti-request-forgery?view=aspnetcore-3.1