title: ASP.NET core iframe authentication cookie
body: <p>I'm having some trouble with my iframe. Whenever I try to login it seems that my authentication cookie isn't working since I just get redirected back to my login screen. How can I fix this?</p>
  <p>The cookie works fine when I'm just running the website normally, but as soon as I display it in iframe it all goes to hell.</p>
  <p>Here is my Startup.cs:</p>
  <pre><code>public class Startup
      {
          public Startup(IConfiguration configuration)
          {
              Configuration = configuration;
            
          }
  
          public IConfiguration Configuration { get; }
  
          // This method gets called by the runtime. Use this method to add services to the container.
          public void ConfigureServices(IServiceCollection services)
          {
              services.AddRazorPages();
              services.AddMvc().AddRazorPagesOptions(o =&gt;
              {
                  o.Conventions.ConfigureFilter(new Microsoft.AspNetCore.Mvc.IgnoreAntiforgeryTokenAttribute());
                  
              });
  
              // Here we set some settings for the authentication cookie, with the class CookieAuthenticationOptions which is a part of the Microsoft.AspNetCore.Authentication.Cookies namespace.
              services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme).AddCookie(options =&gt;
              {
                  // Here we set the name of the authentication cookie.
                  options.Cookie.Name = &quot;AuthCookie&quot;;
                  // Here we set the cookie to Http Only, because no scripts should have access to change the cookie.
                  options.Cookie.HttpOnly = true;
                  // Here we set the cookie to be only send over an HTTPS connection.
                  options.Cookie.SecurePolicy = CookieSecurePolicy.None;
                  // Here we set the SameSite to lax, because not all browser's set cookies without a SameSite value to lax.
                  options.Cookie.SameSite = SameSiteMode.Lax;
                  // Here we set the path to the Access denied site to our AccessDenied site. The site is shown if a user don't have access to the site he/she/it is trying to visit.
                  options.AccessDeniedPath = &quot;/&quot;;
                  // Here we set the login page. The user is redirected to this site if he/she/it is not logged in and the site require the user to be logged in.
                  options.LoginPath = &quot;/&quot;;
                  // Here we set the log out site.
                  options.LogoutPath = &quot;/Logout&quot;;
              });
  
          }
  
          
  
  
  
  
          // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
          public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
          {
              if (env.IsDevelopment())
              {
                  app.UseDeveloperExceptionPage();
              }
              else
              {
                  app.UseExceptionHandler(&quot;/Error&quot;);
                  // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                  app.UseHsts();
              }
  
  
              /* app.Use(async (context, next) =&gt;
               {
                   //
                   //context.Response.Headers.Remove(&quot;X-Frame-Options&quot;);
                   context.Response.Headers.Add(&quot;X-Frame-Options&quot;, &quot;DENY&quot;);
               });*/
  
              app.Use(async (context, next) =&gt;
              {
                  context.Response.Headers.Remove(&quot;X-Frame-Options&quot;);
                  context.Response.Headers.Add(&quot;X-Frame-Options&quot;, &quot;ALLOWALL&quot;);
                  //context.Response.Headers.Add(&quot;Content-Security-Policy&quot;, &quot;frame-ancestors https://kasp151f.000webhostapp.com/&quot;);
                  await next();
              });
  
              // app.UseHttpsRedirection();
              // Here I enable authentication capeabilities for the website.
              app.UseAuthentication();
              // Here I enable authorization capeabilities for the website.
              app.UseAuthorization();
              app.UseStaticFiles();
  
              app.UseRouting();
              
              app.UseAuthorization();
              app.UseEndpoints(endpoints =&gt;
              {
                  endpoints.MapRazorPages();
              });
          }
  
      }
  </code></pre>
  <p>And here is my Iframe:</p>
  <pre><code>&lt;iframe width=&quot;1280&quot; height=&quot;720&quot; frameBorder=&quot;0&quot;  scrolling=&quot;no&quot;  onload=&quot;HandleLocationChange(this, this.contentWindow.location.href)&quot; src=&quot;http://kasperssejeside.tk/&quot;&gt;&lt;/iframe&gt;
  </code></pre>