SameSite cookies IIS - iis

Question

I have tried samesite cookies in IIS. But no luck. how can I do that using in IIS ? BTW , I am using windows server 2012 R2.
config :
<sessionState timeout="60" cookieSameSite="None" />
<httpCookies sameSite="None"/>

Answer 1

This is often managed within the application's startup and initialization.
One way to do this in IIS, rather than your application, is to add an outbound rewrite rule to append SameSite=None to cookies sent in the response.
Example Web.config:
<system.webServer>
<rewrite>
<outboundRules>
<clear />
<rule name="Add SameSite" preCondition="No SameSite">
<match serverVariable="RESPONSE_Set_Cookie" pattern=".*" negate="false" />
<action type="Rewrite" value="{R:0}; SameSite=None" />
</rule>
<preConditions>
<preCondition name="No SameSite">
<add input="{RESPONSE_Set_Cookie}" pattern="." />
<add input="{RESPONSE_Set_Cookie}" pattern="; SameSite=None" negate="true" />
</preCondition>
</preConditions>
</outboundRules>
</rewrite>
</system.webServer>

Answer 2

According to MSFT documents:
The behavior of None was modified by updates described in KB article 4531182 and KB article 4524421.
Without these updates, the None value does not emit the SameSite cookie header
I suggest you could firstly install the KB article 4531182 and KB article 4524421 update and then it will work well.
More details, you could refer to below article:
https://learn.microsoft.com/en-us/dotnet/api/system.web.samesitemode?view=netframework-4.8#remarks