Updates regarding IIS and SameSite attribute

 Here is a post on the recent updates regarding IIS and SameSite attribute.

Recently, Microsoft announced that IIS can now be configured to use the SameSite attribute directly in the Web.config file. This means that IIS can now be configured to use the SameSite attribute without needing to use any code.

In the latest versions of IIS, all that is needed is to add the following configuration to the system.web node in the Web.config file to set the SameSite attribute to Strict:

```

<system.web>

  <httpCookies requireSSL="true" httpOnlyCookies="true" sameSite="Strict" />

</system.web>

```

This code sets the `requireSSL` attribute to `true`, which means that the cookie can only be accessed using the HTTPS protocol. It also sets the `httpOnlyCookies` attribute to `true`, which prevents client-side scripts from accessing the cookie through the `document.cookie` API. Finally, the `sameSite` attribute is set to `Strict`, which means that the cookie will only be sent to the website if the requested URL exactly matches the hostname of the website.

One of the benefits of using the Web.config file to configure the SameSite attribute is that it provides a centralized location for managing all the settings for the website. This simplifies the maintenance and management of the code, and increases the security and stability of the website. Additionally, because the Web.config file is typically stored in the root directory of the website, it is easy to deploy and manage the website.

It is important to note that the ability to configure the SameSite attribute using the Web.config file requires IIS version 10.0.17763.0 or higher. If your IIS version is older than this, you will need to use a different method to configure the SameSite attribute. Also, it is recommended that you carefully read Microsoft's official documentation to ensure that your configuration is correct and effective.

In summary, using the Web.config file to configure the SameSite attribute is a simple and effective way to increase the security and stability of your website. If you have not yet configured your website to use this feature, it is recommended that you update to the latest version of IIS and follow Microsoft's official guidelines for configuration.