ASP.NET Core Interview Question #148

What security settings are important for authentication cookies?

Authentication, Authorization & Security Mid-Level Intermediate

Quick Interview Answer

Authentication cookies should normally be HttpOnly so client-side scripts cannot read them, Secure so they are sent over HTTPS, and configured with an appropriate SameSite policy for the application's authentication and cross-site requirements.

Detailed Explanation

Cookie names, expiration, sliding expiration, login paths, and data-protection key management also affect security and reliability. SameSite should not be set mechanically because external login and cross-site flows may require specific behavior.

Code Example

builder.Services.AddAuthentication("AppCookie")
    .AddCookie("AppCookie", options =>
    {
        options.Cookie.HttpOnly = true;
        options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
        options.Cookie.SameSite = SameSiteMode.Lax;
        options.ExpireTimeSpan = TimeSpan.FromMinutes(30);
    });