# .AspNet.Litium Is not set in CORS requests

**URL:** <https://forum.litium.com/t/aspnet-litium-is-not-set-in-cors-requests/1966>\
**Category:** Questions\
**Created:** [April 6, 2021, 10:02am UTC](https://forum.litium.com/t/aspnet-litium-is-not-set-in-cors-requests/1966 "2021-04-06T10:02:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Robin.w](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.litium.com/robin.w/32/75_2.png) [@Robin.w](https://forum.litium.com/u/Robin.w)\
**Post date:** [April 6, 2021, 10:02am UTC](https://forum.litium.com/t/aspnet-litium-is-not-set-in-cors-requests/1966/1 "2021-04-06T10:02:11Z")

</div>

Hi, when calling an web api that uses \_loginService.Login() to log in the user, the set cookie header for the .AspNet.Litium cookie is not present in the response. But if i call the same endpont form the same domain, the set-cookie is there.

Where is this cookie set?  
Is there a security check somewhere? Also, if i want to change the SameSite or Secure setting on this cookie, where should i do this?

Thanks

Litium version: 7.6

---

<div class="post-metadata">

**Author:** ![Spotonkastebo](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.litium.com/spotonkastebo/32/717_2.png) [@Spotonkastebo](https://forum.litium.com/u/Spotonkastebo)\
**Post date:** [April 6, 2021, 11:29am UTC](https://forum.litium.com/t/aspnet-litium-is-not-set-in-cors-requests/1966/2 "2021-04-06T11:29:38Z")

</div>

To answer your second question. Depending on version of litium or rather [asp.net](http://asp.net) you can do it from web.config or via url-rewrite.  
If you have older version of litium with older version of .net you can’t do it from web.config.

> **[Work with SameSite cookies in ASP.NET](https://docs.microsoft.com/en-us/aspnet/samesite/system-web-samesite)**
>
> Learn how to use to SameSite cookies in ASP.NET

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex030/uploads/litium/original/1X/12eddac3b8b661de1db86af10ac8151b571e6fb9.png) [@system](https://forum.litium.com/u/system)\
**Post date:** [May 4, 2021, 11:30am UTC](https://forum.litium.com/t/aspnet-litium-is-not-set-in-cors-requests/1966/3 "2021-05-04T11:30:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.