0

My application at mysubdomain.mydomain.com needs to set a cookie that contains some user session information.

They log in at a https page. We authenticate them and set some session info in a cookie.

We do this in a helper library that takes in the controller context

contextBase.Response.Cookies[CookiePayload.CookieName].Value = encryptedTicket;                       
contextBase.Response.Cookies[CookiePayload.CookieName].Expires = cookieExpires;
contextBase.Response.Cookies[CookiePayload.CookieName].Domain= ConfigHelper.CookieDomain;
contextBase.Response.Cookies[CookiePayload.CookieName].HttpOnly=true;

We do a quick redirect in the controller (to a non https page):

this.ControllerContext.HttpContext.Response.Redirect(redirectTo, false);
return null;

The cookie appears in the response (according to firebug's net tab).

But neither fireforx nor ie send the cookie on subsequent gets.

We are setting the cookie domain to mydomain.com even though the site is mysubdomain.mydomain.com. Skipping the redirect command has no effect, nor does changing the cookie value.

I'm baffled. Thanks for any suggestions.

1 Answer 1

4

Try explicitly setting the Secure flag to false if this cookie needs to be sent over http:

var cookie = new HttpCookie(CookiePayload.CookieName, encryptedTicket)
{
    HttpOnly = true,
    Domain = ConfigHelper.CookieDomain,
    Secure = false,
    Expires = cookieExpires
};
Response.SetCookie(cookie);
Sign up to request clarification or add additional context in comments.

1 Comment

That seems to have done it. It seems that ASP was setting it to secure by default because the context was an https request. Thanks!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.