Cookie issue .Net core and Angular web app

Madan Shekar

6y3.1k.NET

Hello everyone,

we are reading the cookie at the client-side, (angular js ) and in the server-side we are using an attribute anti-forgery token attribute in controller level (.Net core).

In case if I made a cookie as httponly in the sense all POST method API's are failing.

Please let me know how to fix this issue or what is the root cause (off course I am aware of if I made httponly true in the sense I cannot read the cookie value in client side)

Thanks

Madan S B

9 Replies

Know the answer? Post it — somebody with the same question will find it here.

Kiran Mohanty5y ago
Hey,
Can you please try once with below code?
public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    app.UseCookiePolicy(new CookiePolicyOptions
    {
        HttpOnly = HttpOnlyPolicy.Always
    });
}
+1
gibran aakib5y ago
Hi follow this channel for .NET Core & Angular 11 Tutorials :- https://youtu.be/OL8Ie0Affdg just recently started to explain from scratch to finish
+1
Madan Shekar6y ago
I need to set HttpOnly = true

context.Response.Cookies.Append(“XSRF-TOKEN”,
tokens.RequestToken, new CookieOptions {
HttpOnly = false,
Secure = true
}

After setting HttpOnly =true post methods are not working
+1
Madan Shekar6y ago
can i use that code in .net core startup.cs file ?
+1
Jignesh Kumar6y ago
Hi Madan,

I mean you need to do like this,
context.Response.Cookies.Append(“XSRF-TOKEN”,
tokens.RequestToken, new CookieOptions {
HttpOnly = false,
Secure = true
}
+1
Madan Shekar6y ago
in angular we are using the XSRF-TOKEN
+1
Jignesh Kumar6y ago
Hi Madan,

If you are using angular js then you no need to add "XSRF-TOKEN"

https://forums.asp.net/t/2134077.aspx?Why+AntiForgeryToken+validation+keeps+failing+
+1
Madan Shekar6y ago
Jignesh i am using same code. the problem is i am setting httponly to true like.

context.Response.Cookies.Append("XSRF-TOKEN", tokens.RequestToken, new CookieOptions() { HttpOnly = true});
+1
Jignesh Kumar6y ago
Hi Madan,

Please have a look at these links,
https://stackoverflow.com/questions/49410813/net-core-api-with-angular-4-the-cookie-token-and-the-request-token-were-swapp
https://docs.microsoft.com/en-us/aspnet/core/security/anti-request-forgery?view=aspnetcore-3.1
+1