[BUG] 5.2.3 - Cookies with HttpOnly=True unable to be accessed while using Interactive Render Mode (SignalR + Javascript Interop).

[thabaum]

Oqtane Info

Version - 5.2.3
Render Mode - Interactive
Interactivity - Server/WebAssembly
Database - SQL Server

Describe the bug

LanguageSwitcher does not switch language (Interactive Server / Interactive Webassembly) because of httpOnly culture cookie set to true and SignalR using JavaScript interop not allowing Oqtane to able to access these cookies directly.

Taken from discussion #4703

Expected Behavior

Culture (and visitor?) Cookie can be accessed while

Steps To Reproduce

Attempt switching languages via the LanguageSwitcher.razor control in the menu while using interactive render mode site setting.

Anything else?

Set 'HttpOnly=false' if render mode for the site is Interactive

Works OK while in Static Render Mode.

Can these cookies be created using middleware to avoid JavaScript?

https://learn.microsoft.com/en-us/dotnet/api/microsoft.net.http.headers.setcookieheadervalue.httponly?view=aspnetcore-8.0

https://learn.microsoft.com/en-us/dotnet/api/microsoft.net.http.headers.setcookieheadervalue?view=aspnetcore-8.0

[thabaum]

@sbwalker this issue is ONLY in interactive mode as I believe static rendering uses HTTP.

Just to be sure
If static: HttpOnly = True

and

If Interactive: HttpOnly = false // cookie is updated using JS Interop

I just want to be sure we want this set to false for static as well if it is working with static set to true. I believe it is the signalR that makes it javascript calls instead of http? Would this be correct? Which is my suggestion to check which mode is set to avoid XSS attacks in Static (http) calls.

Please correct me if I am wrong.

I would also like to review the visitor cookie as well working in both interactive and static modes.