0
nhontran created
- ABP Framework version: v5.2.2
- UI type: Angular
- DB provider: EF Core
- Tiered (MVC) or Identity Server Separated (Angular): yes / no
- Exception message and stack trace:
- Steps to reproduce the issue:"
Hi, we received a pen test finding indicating that we need to enable the 'Secure' flag for the '.AspNetCore.Culture' cookie:
I have tried to enable by adding this code but it does not work:
Configure<CookiePolicyOptions>(options =>
{
options.Secure = CookieSecurePolicy.Always;
});
Configure<AntiforgeryOptions>(options =>
{
options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
});
could you please assist us on this request?
Markdown supported.
Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
4 Answer(s)
-
0
Hi,
You can try this:
public override void OnApplicationInitialization(ApplicationInitializationContext context) { var env = context.GetEnvironment(); var app = context.GetApplicationBuilder(); app.UseCookiePolicy(new CookiePolicyOptions() { OnAppendCookie = cookieContext => { if (cookieContext.CookieName == CookieRequestCultureProvider.DefaultCookieName) { cookieContext.CookieOptions.Secure = true; } } }); ........ }Markdown supported.Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post) -
0
I feel the cookie is created at the front-e
yes.. that provider created language cookie. You can override too with TOKEN. https://github.com/abpframework/abp/blob/dev/npm/ng-packs/packages/core/src/lib/providers/cookie-language.provider.ts
Markdown supported.Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
