37

I faced a problem.

When you add multiple Set-Cookie headers to the response

headers.Add("Set-Cookie", "a=b;Path=/;");
headers.Add("Set-Cookie", "c=d;Path=/;");

actually they are combined and only one header is sent with comma-separated cookies

Set-Cookie: a=b;Path=/;,c=d;Path=/;

According to RFC2109 it is a valid syntax. But it is not according to RFC6265, which deprecates RFC2109

Moreover latest browsers does not support this comma-separated syntax as well. Tested on IE9, Firefox 13 and Google Chrome 20.

All of these browsers took first cookie only.

Please see the sample project below

https://github.com/mnaoumov/cookie-bug/

I want to find some workaround.

I expect to have two different Set-Cookie headers.

I tried to write some MessageInspector to rewrite HTTP headers. I could not find how to access that headers.

Any ideas?

P.S. Used technology: Web API

Jeff Ward
  • 16,563
  • 6
  • 48
  • 57
mnaoumov
  • 2,146
  • 2
  • 22
  • 31
  • Raised a bug on __codeplex__. http://aspnetwebstack.codeplex.com/workitem/288 – mnaoumov Jul 25 '12 at 02:35
  • 3
    Just FYI, here's the bit that prohibits comma separated cookies under a single header: "_An origin server can include multiple Set-Cookie header fields in a single response. … Origin servers SHOULD NOT fold multiple Set-Cookie header fields into a single header field._" - from [RFC 6265 - HTTP State Management Mechanism (overview section)](https://tools.ietf.org/html/rfc6265#section-3) – Sepster Feb 08 '17 at 07:10

2 Answers2

9

According to answer on codeplex (http://aspnetwebstack.codeplex.com/workitem/288) this issue is known issue and related to WCF self-hosting and should be fixed by moving to IIS hosting.

This is WCF 4 issue which marked as won't fix.

Found another question with the same outcome WCF 4.0 Cookie Only First is Recorded by Browser.

Community
  • 1
  • 1
mnaoumov
  • 2,146
  • 2
  • 22
  • 31
1

You can use the HttpContext.Current.Response.SetCookie

using System.Web;


HttpCookie foo = new HttpCookie("foo", "true");
HttpContext.Current.Response.Cookies.Add(foo); 

HttpCookie bar = new HttpCookie("bar", "true");
HttpContext.Current.Response.Cookies.Add(bar);

This will add multiple set-cookies header in the response.

Edit: also, you should add the 

<serviceHostingEnvironment multipleSiteBindingsEnabled="true" aspNetCompatibilityEnabled="true"/>

in your web.config

tom2020
  • 11
  • 3