diff --git a/docs/reference/options.rst b/docs/reference/options.rst index 5c4ed7b66d..49215a1e89 100644 --- a/docs/reference/options.rst +++ b/docs/reference/options.rst @@ -56,6 +56,9 @@ Authentication * ``CheckSessionCookieDomain`` The domain of the cookie used for the check session endpoint. +* ``CheckSessionCookieSameSiteMode`` + The SameSite mode of the cookie used for the check session endpoint. + * ``RequireCspFrameSrcForSignout`` If set, will require frame-src CSP headers being emitting on the end session callback endpoint which renders iframes to clients for front-channel signout notification. Defaults to true. diff --git a/src/IdentityServer4/src/Configuration/DependencyInjection/Options/AuthenticationOptions.cs b/src/IdentityServer4/src/Configuration/DependencyInjection/Options/AuthenticationOptions.cs index 7b68cca982..c77aff4ff9 100644 --- a/src/IdentityServer4/src/Configuration/DependencyInjection/Options/AuthenticationOptions.cs +++ b/src/IdentityServer4/src/Configuration/DependencyInjection/Options/AuthenticationOptions.cs @@ -51,6 +51,11 @@ public class AuthenticationOptions /// public string CheckSessionCookieDomain { get; set; } + /// + /// Gets or sets the SameSite mode of the cookie used for the check session endpoint. Defaults to SameSiteMode.None. + /// + public SameSiteMode CheckSessionCookieSameSiteMode { get; set; } = SameSiteMode.None; + /// /// If set, will require frame-src CSP headers being emitting on the end session callback endpoint which renders iframes to clients for front-channel signout notification. /// diff --git a/src/IdentityServer4/src/Services/Default/DefaultUserSession.cs b/src/IdentityServer4/src/Services/Default/DefaultUserSession.cs index 27b5be0415..ffb395fd07 100644 --- a/src/IdentityServer4/src/Services/Default/DefaultUserSession.cs +++ b/src/IdentityServer4/src/Services/Default/DefaultUserSession.cs @@ -67,6 +67,14 @@ public class DefaultUserSession : IUserSession /// protected string CheckSessionCookieDomain => Options.Authentication.CheckSessionCookieDomain; + /// + /// Gets the SameSite mode of the check session cookie. + /// + /// + /// The SameSite mode of the check session cookie. + /// + protected SameSiteMode CheckSessionCookieSameSiteMode => Options.Authentication.CheckSessionCookieSameSiteMode; + /// /// The principal /// @@ -238,7 +246,7 @@ public virtual CookieOptions CreateSessionIdCookieOptions() Path = path, IsEssential = true, Domain = CheckSessionCookieDomain, - SameSite = SameSiteMode.None + SameSite = CheckSessionCookieSameSiteMode }; return options;