Adding multiple Set-Cookie Headers in ASP.NET Web

Question

I faced a problem.

When you add multiple Set-Cookie headers to the response

headers.Add("Set-Cookie", "a=b;Path=/;");
headers.Add("Set-Cookie", "c=d;Path=/;");

actually they are combined and only one header is sent with comma-separated cookies

Set-Cookie: a=b;Path=/;,c=d;Path=/;

According to RFC2109 it is a valid syntax. But it is not according to RFC6265, which deprecates RFC2109

Moreover latest browsers does not support this comma-separated syntax as well. Tested on IE9, Firefox 13 and Google Chrome 20.

All of these browsers took first cookie only.

Please see the sample project below

https://github.com/mnaoumov/cookie-bug/

I want to find some workaround.

I expect to have two different Set-Cookie headers.

I tried to write some MessageInspector to rewrite HTTP headers. I could not find how to access that headers.

Any ideas?

P.S. Used technology: Web API

Raised a bug on codeplex. aspnetwebstack.codeplex.com/workitem/288 — mnaoumov
– mnaoumov, Commented Jul 25, 2012 at 2:35
Just FYI, here's the bit that prohibits comma separated cookies under a single header: "An origin server can include multiple Set-Cookie header fields in a single response. … Origin servers SHOULD NOT fold multiple Set-Cookie header fields into a single header field." - from RFC 6265 - HTTP State Management Mechanism (overview section) — Sepster
– Sepster, Commented Feb 8, 2017 at 7:10

Community · Accepted Answer · 2017-05-23 11:45:36Z

9

According to answer on codeplex (http://aspnetwebstack.codeplex.com/workitem/288) this issue is known issue and related to WCF self-hosting and should be fixed by moving to IIS hosting.

This is WCF 4 issue which marked as won't fix.

Found another question with the same outcome WCF 4.0 Cookie Only First is Recorded by Browser.

edited May 23, 2017 at 11:45

CommunityBot

11 silver badge

answered Jul 29, 2012 at 4:08

mnaoumov

2,2373 gold badges23 silver badges35 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

tom2020 · Accepted Answer · 2016-04-21 19:24:25Z

1

You can use the HttpContext.Current.Response.SetCookie

using System.Web;


HttpCookie foo = new HttpCookie("foo", "true");
HttpContext.Current.Response.Cookies.Add(foo); 

HttpCookie bar = new HttpCookie("bar", "true");
HttpContext.Current.Response.Cookies.Add(bar);

This will add multiple set-cookies header in the response.

Edit: also, you should add the

<serviceHostingEnvironment multipleSiteBindingsEnabled="true" aspNetCompatibilityEnabled="true"/>

in your web.config

edited Apr 21, 2016 at 19:24

answered Apr 21, 2016 at 18:51

tom2020

113 bronze badges

Collectives™ on Stack Overflow

Adding multiple Set-Cookie Headers in ASP.NET Web

2 Answers 2

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related