If the application targets the .NET Framework 4.7.2 or later versions, the default value is Lax; otherwise, the default value is None.

<system.web>
  <sessionState cookieSameSite="None" />
</system.web>

• Before the patch a value of None meant:
  • Do not emit the attribute at all.
• After the patch:
  • A value of None means "Emit the attribute with a value of None".
  • The default SameSite value for forms authentication and session state cookies was changed from None to Lax.

<system.web>
  <httpCookies sameSite="None" />
  <sessionState cookieSameSite="None" />
</system.web>

public void ConfigureServices(IServiceCollection services)
{
    services.Configure<CookiePolicyOptions>(options =>
    {
        options.MinimumSameSitePolicy = SameSiteMode.None;
        options.OnAppendCookie = cookieContext =>
            CheckSameSite(cookieContext.Context, cookieContext.CookieOptions);
        options.OnDeleteCookie = cookieContext =>
            CheckSameSite(cookieContext.Context, cookieContext.CookieOptions);

    });

    services.AddRazorPages();
}


public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }
    else
    {
        app.UseExceptionHandler("/Error");
        app.UseHsts();
    }

    app.UseHttpsRedirection();
    app.UseStaticFiles();

    app.UseRouting();

    //This should be called before calling UseAuthentication or any method that writes cookie
    app.UseCookiePolicy();
    app.UseAuthentication();
    app.UseAuthorization();

    app.UseEndpoints(endpoints =>
    {
        endpoints.MapRazorPages();
    });
}

private void CheckSameSite(HttpContext httpContext, CookieOptions options)
{
    if (options.SameSite == (SameSiteMode)(-1)) //For .NET Core 3.1+, you can use SameSiteMode.Unspecified
    {
        options.SameSite = SameSiteMode.None;
    }
}

• Added: GleamTechWebConfiguration.CookieSameSiteFixEnabled property which can be used to fix session issues when
  you are using DocumentViewer in an iframe with a cross-domain URL (default value is false).

  If you open DocumentViewer in an iframe with a cross-domain URL, recent browsers will not allow the session cookie to be set
  inside iframe due to default security settings (could be overridden in your browser) and the component will fail to find the existing session from the server.
  When enabled, by default SameSiteMode.None will be used for the cookies.

  Note that Chrome 80+ allows SameSiteMode.None only if the cookie is also marked Secure and we will mark it Secure when the request is secure (HTTPS).
  So even with this fix if your cross-domain URL is not HTTPS, Chrome 80+ still does not allow the cookie in cross domain iframe (with default browser settings).
  Fix works on IE and Firefox even if your cross-domain URL is not HTTPS.
  Also, the fix can only work when your application is running on ASP.NET 4.7.2+ runtime (not target framework but deployment machine runtime)
  or ASP.NET Core runtime.

<iframe src="crossDomain.com/myFileManagerPage"></iframe>

• For ASP.NET Classic, in Web.config (works only if running on ASP.NET 4.7.2+ runtime because HttpCookie.SameSite property is only available starting with that version):

<configuration>
  <appSettings>
    <add key="GleamTechWeb:CookieSameSiteFixEnabled" value="true"/>
  </appSettings>

• For ASP.NET Core, in appsettings.json:

{
    "GleamTechWeb:CookieSameSiteFixEnabled": true
}

• or from code, in global.asax.cs or Startup.cs:

GleamTech.AspNet.GleamTechWebConfiguration.Current.CookieSameSiteFixEnabled = true;

• Chrome 80+ requires "SameSite=None; Secure" for the session cookie so even if you turn on the fix, you will need to use a HTTPS URL (SSL) in your iframe, otherwise Chrome 80+ still does not allow session in iframe (note that new Edge is also Chrome based so same will apply):

<iframe src="https://crossDomain.com/myFileManagerPage"></iframe>

• Other browsers such as IE and Firefox require "SameSite=None" (for now, probably they will follow Chrome in future) so when you turn on the fix, it should work even if you use HTTP URL (no SSL)

• Added: Cookieless session will be used when necessary to automatically fix session issues, i.e. when the browser
  does not allow cookies via browser settings or via iframe with a cross-domain URL.
  The cookieless session will be established via headers, form or querystring where possible.

  Added GleamTechWebConfiguration.AutoCookielessSessionEnabled property to control this feature (default value is true).
  You don't need to use GleamTechWebConfiguration.CookieSameSiteFixEnabled when this property is true.

• Fixed: When <sessionState cookieless="true" /> was set in Web.config, the below error was being thrown:
  'Invalid method request: Method with name "" not found'