Set-Cookie Header with Multiple Cookies

Question

I have a problem.

When you add multiple Set-Cookie headers to the response

headers.Add("Set-Cookie", "a=b;Path=/;"); headers.Add("Set-Cookie", "c=d;Path=/;"); 

in fact, they are merged and only one header is sent with comma-delimited cookies

 Set-Cookie: a=b;Path=/;,c=d;Path=/; 

According to RFC2109, it is a valid syntax. But this is not consistent with RFC6265 , which depreciates RFC2109

In addition, recent browsers do not support this comma-separated syntax. Tested on IE9 , Firefox 13 and Google Chrome 20 .

All of these browsers used only the first cookie.

Please see example project below.

https://github.com/mnaoumov/cookie-bug/

I want to find some workaround.

I expect two different Set-Cookie headers.

I tried to write some MessageInspector to rewrite HTTP headers. I could not find how to access these headers.

Any ideas?

PS Technology Used: Web Interface

Answer 1

In response to codeplex ( http://aspnetwebstack.codeplex.com/workitem/288 ), this problem is known and is related to WCF itself -hosting and should be fixed by switching to IIS hosting.

This is a WCF 4 issue, marked as , will not be fixed.

Found another question with the same result WCF 4.0 Cookie Only First is recorded by the browser .

Answer 2

You can use HttpContext.Current.Response.SetCookie

 using System.Web; HttpCookie foo = new HttpCookie("foo", "true"); HttpContext.Current.Response.Cookies.Add(foo); HttpCookie bar = new HttpCookie("bar", "true"); HttpContext.Current.Response.Cookies.Add(bar); 

In response, the header of several cookies will be added.

Edit: you must also add

 <serviceHostingEnvironment multipleSiteBindingsEnabled="true" aspNetCompatibilityEnabled="true"/> 

in your web.config