Response cookies Append inconsistently applies SameSite default

[aspnet-hello]

From @Tratcher on Wednesday, December 27, 2017 9:11:02 AM

The two Append overloads have inconsistent behavior for the samesite property that was added in 2.0.

                context.Response.Cookies.Append("Name1", "Value1");
                context.Response.Cookies.Append("Name2", "Value2", new CookieOptions());

Set-Cookie:Name1=Value1; path=/
Set-Cookie:Name2=Value2; path=/; samesite=lax

The two overloads should have the same defaults.

I noticed because we're making changes to CookiePolicy for http://github.com/aspnet/Security/issues/1561 and adding it to the templates. This will have the side-effect of causing the Append API to consistently use the second overload's behavior.

Copied from original issue: aspnet/HttpAbstractions#982

[muratg]

This is a bug, but fixing it is a breaking change. We'll fix this in 3.0.0.

[muratg]

@Tratcher feel free to close if you feel breaking change is not worth it.

[Tratcher]

SameSite has been such a mine field that the best default here would likely be None. That goes for CookiePolicy as well. We can turn it up for specific components.

@blowdart

[blowdart]

Yea sigh :( None should be the default.