how to protect Google Chrome 80 beta asp + iframe - iis

Question

The web service environment is operated by Windows 2012 server, IIS8.5, Classic asp.
this is problem about Chrome 80ver SameSite Issue.
On our site, we make payments by calling iframes and receive the results by returnurl.
However, there is a problem in returnurl that changes the existing session value (sometimes it is maintained and sometimes it is changed).
I tried to
First. Add header in source code as follows
Response.AddHeader "Set-Cookie", "SameSite=None; Secur; path=/; HttpOnly"
Second. Add web.config
<system.web>
<httpCookies httpOnlyCookies="true" requireSSL="true" sameSite="None" />
<sessionState cookieSameSite="None" />
Third. Add web.config rewrite
<rewrite>
<outboundRules>
<rule name="AddSameSiteCookieFlag">
<match serverVariable="RESPONSE_Set-Cookie" pattern="^(.*SessionID)(SameSite=Lax)" />
<action type="Rewrite" value="{R:1};SameSite=None" />
</rule>
</outboundRules>
Is there a way to set the samesite setting to none in IIS8.5?

Answer 1

I'm running the exact configuration mentioned in this question and found the following web.config rewrite rules to work as a baseline solution:
<rewrite>
<outboundRules>
<rule name="Add HttpOnly" preCondition="No HttpOnly">
<match serverVariable="RESPONSE_Set_Cookie" pattern=".*" negate="false" />
<action type="Rewrite" value="{R:0}; HttpOnly" />
<conditions>
</conditions>
</rule>
<rule name="Add SameSite" preCondition="No SameSite">
<match serverVariable="RESPONSE_Set_Cookie" pattern=".*" negate="false" />
<action type="Rewrite" value="{R:0}; SameSite=None; Secure" />
</rule>
<preConditions>
<preCondition name="No HttpOnly">
<add input="{RESPONSE_Set_Cookie}" pattern="." />
<add input="{RESPONSE_Set_Cookie}" pattern="; HttpOnly" negate="true" />
</preCondition>
<preCondition name="No SameSite">
<add input="{RESPONSE_Set_Cookie}" pattern="." />
<add input="{RESPONSE_Set_Cookie}" pattern="; SameSite=None; Secure" negate="true" />
</preCondition>
</preConditions>
</outboundRules>
</rewrite>