Why AspNet Core 2.2 server side created cookie missing in Facebook WebView? - facebook

Question

We have run into a problem using aspnet core 2.2 with Facebook WebView (https://developers.facebook.com/docs/messenger-platform/webview/).
The issue occurs only in desktop browsers using chat function in messenger.com or facebook.com.
We have developed a chatbot and there are buttons in the conversation. When the user click that button a WebView shows our webpage.
This webapplication is an aspnet core mvc webapp (hosten in Azure App Service) where a controller action at server side creates a cookie and writes it into the Response.
var cookieOptions = new CookieOptions()
{
IsEssential = true,
Expires = DateTime.UtcNow.AddYears(1),
};
Response.Cookies.Append("COOKIE_NAME", "cookievalue", cookieOptions);
When this page loaded from a Facebook WebView (from a FB chatbot) the cookie created above (on server side) is missing.
In the aspnet core web project Startup.cs cookie middleware is configured like this:
public void ConfigureServices(IServiceCollection services)
{
...
services.Configure<CookiePolicyOptions>(options =>
{
options.CheckConsentNeeded = context => false;
options.MinimumSameSitePolicy = SameSiteMode.None;
});
...
}
public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
...
app.UseCookiePolicy();
...
}
What I've tried:
if the same cookie inserted from client side javascript, the cookie is available in Facebook webview.
document.cookie = "COOKIE_NAME=cookievalue";
Same scenario works correctly using asp.net fwk 4.7.2 and Facebook webview.
from a mobile app (messenger) it works as I expected, cookie available
I think the problem source could be in the WebView, because the page works perfectly when loaded from a normal browser – not from WebView (Chrome, IE, Edge, FF, Safari, etc), both cookie (server and client side created) are available.
What could be the problem with scenario using aspnet core 2.2 and Facebook WebView?
Thanks for helping!

Answer 1

At the end I found the problem. The chrome's cookie policy settings changed: https://www.google.com/chrome/privacy/
Thats why I run into the problem above.
Solution:
I have to change these cookies samesite settings to 'SameSiteMode.None'.
var cookieOptions = new CookieOptions()
{
Secure = true,
SameSite = SameSiteMode.None,
IsEssential = true,
Expires = DateTime.UtcNow.AddYears(1),
};