Same site cookie attribute set vb.net

you’re asking how to set a SameSite cookie attribute in VB.NET (ASP.NET).
Let’s go step-by-step 

 What is the SameSite Cookie Attribute?

The SameSite attribute controls how cookies are sent with cross-site requests to improve security and prevent CSRF attacks.

Possible values:

• None → cookie is sent in all requests (must also have Secure=True for HTTPS)

• Lax → cookie sent only on top-level GETs (default for most browsers)

• Strict → cookie sent only for same-site requests

 How to Set SameSite Attribute in VB.NET

 Option 1: Set it directly when creating a cookie

Dim cookie As New HttpCookie("UserSession")
cookie.Value = "Sandhiya123"
cookie.HttpOnly = True
cookie.Secure = True ' Required when SameSite=None
cookie.SameSite = SameSiteMode.None
cookie.Expires = DateTime.Now.AddHours(1)
Response.Cookies.Add(cookie)

 Option 2: Set globally in web.config (for all cookies)

You can enforce SameSite behavior in your Web.config:

 Note: requireSSL="true" ensures cookies are sent only via HTTPS, which is required when SameSite=None.

 Option 3: Fix cookies generated by FormsAuthentication

If you’re using ASP.NET Forms Authentication, set SameSite for the auth cookie in Global.asax:

Sub Application_PostAuthenticateRequest(ByVal sender As Object, ByVal e As EventArgs)
    Dim authCookie = Response.Cookies(FormsAuthentication.FormsCookieName)
    If authCookie IsNot Nothing Then
        authCookie.SameSite = SameSiteMode.None
        authCookie.Secure = True
    End If
End Sub

 Option 4: Modify cookies dynamically (for older .NET versions)

If your .NET Framework version doesn’t support .SameSite property (e.g., before 4.7.2),
you can append the attribute manually:

Response.AppendHeader("Set-Cookie", "UserSession=Sandhiya123; SameSite=None; Secure; HttpOnly; Path=/")

 Recommended Settings (for SSO apps)

If your app uses Single Sign-On (SSO) or any cross-domain login, use:

cookie.SameSite = SameSiteMode.None
cookie.Secure = True

Otherwise, for a normal internal app (no external redirect), use:

cookie.SameSite = SameSiteMode.Lax

 Quick Example (Full VB.NET Code)

Protected Sub Page_Load(ByVal sender As Object, ByVal e As EventArgs) Handles Me.Load
    Dim cookie As New HttpCookie("MyLoginCookie")
    cookie.Value = "User123"
    cookie.Expires = DateTime.Now.AddHours(2)
    cookie.HttpOnly = True
    cookie.Secure = True
    cookie.SameSite = SameSiteMode.None
    Response.Cookies.Add(cookie)
End Sub

In VB.NET (ASP.NET), you can set the SameSite attribute of a cookie using the HttpCookie class or Response.Cookies depending on whether you are using .NET Framework or .NET Core/ASP.NET Core. Here's a concise guide:

ASP.NET (.NET Framework)

Dim cookie As New HttpCookie("MyCookie")
cookie.Value = "SomeValue"
cookie.Expires = DateTime.Now.AddDays(7)
cookie.SameSite = SameSiteMode.Strict  ' Options: None, Lax, Strict
Response.Cookies.Add(cookie)

Notes:

• SameSiteMode.Strict → Cookie sent only for same-site requests.

• SameSiteMode.Lax → Cookie sent for top-level navigation GET requests.

• SameSiteMode.None → Cookie sent in all contexts (requires Secure = True).

If SameSite=None, you must set Secure = True for modern browsers.

For cross-site scenarios (like SSO or third-party login), SameSite=None is needed.