Why Antiforgery CookieSecurePolicy not applying?

Question

I want to make my Antiforgery cookies secured, so I add some changes to my code:

    services.AddMvc();

    services.AddAntiforgery(opts => {
        opts.Cookie.HttpOnly = true;
        opts.Cookie.SecurePolicy = CookieSecurePolicy.Always;
        opts.Cookie.Domain = "localhost";
        opts.Cookie.SameSite = SameSiteMode.Strict;
    });

But even after I set secure policy, there are no changes on my cookies: Antiforgery cookies not secured, browser connection is secured (https).

Answer 1

The correct way for .net core 2.1 is to add the next code to your Startup.cs:

        var cookiePolicyOptions = new CookiePolicyOptions
        {
            MinimumSameSitePolicy = SameSiteMode.Strict,
            Secure = CookieSecurePolicy.Always,
        };
        app.UseCookiePolicy(cookiePolicyOptions);

You also could check documentation about cookies setup here.