none
Cookie for domain not being used for subdomains

    Question

  • I use HttpClient in my app to send my user/password to a service that returns some cookies that I can later use for all my other requests. The service is located at `https://accounts.dev.example.com/login` and returns two cookies that have `Domain=.dev.example.com`. The issue I'm finding is that, in some machines (Windows Domain Controllers), these cookies are not being used when I request resources in subdomains like `https://accounts.dev.example.com/health-check`, but according to the MDN docs a cookie for a domain can be used for requesting resources to subdomains:

    *Domain=<domain-value> Optional*

    Specifies those hosts to which the cookie will be sent. If not specified,
    defaults to the host portion of the current document location (but not
    including subdomains). Contrary to earlier specifications, leading dots in
    domain names are ignored. **If a domain is specified, subdomains are always
    included.**


    Do you know how to properly configure `HttpClient` to pass the domain cookies to subdomain requests?

    A bit more of details:

    The cookies returned by my authentication service at `https://accounts.dev.example.com/login` look like this in the HTTP headers:

    Set-Cookie: AK=112233;Version=1;Domain=.dev.example.com;Path=/;Max-Age=5400;Secure;HttpOnly, 
    Set-Cookie: AS=445566;Version=1;Domain=.dev.example.com;Path=/;Max-Age=5400;Secure;HttpOnly, 
    Then I can query C#'s `CookieContainer` with either of these calls in normal workstations:
    cookies.GetCookies("https://accounts.dev.example.com")
    cookies.GetCookies("https://dev.example.com")
    Both of which will return the 2 cookies like:
    $Version=1; AK=112233; $Path=/; $Domain=.dev.example.com
    $Version=1; AS=445566; $Path=/; $Domain=.dev.example.com
    But in the other machines (the Domain Controller's) the first call will return an empty list, while the second will return the 2 cookies.

    Why this difference on the behaviour of CookieContainer.GetCookies depending on which machine is running the code?

    My workstations are using `Microsoft Windows 10 Home Single Language (.Net 4.0.30319.42000)` and the DCs are using `Microsoft Windows Server 2012 R2 Datacenter (.Net 4.0.30319.36399)`.

    Temporary solution

    This is my solution so far, which works, but not sure if there is a proper way of solving the issue:

        foreach (Cookie cookie in cookies.GetCookies(new Uri("https://dev.example.com")))
        {
            cookies.Add(new Uri("https://accounts.dev.example.com"), new Cookie(cookie.Name, cookie.Value, cookie.Path, ".accounts.dev.example.com"));
        }
    So, I'm duplicating the cookie for each one of the subdomains that my app should send these cookies to,

    The code

    This is a modified version of my code:

     
       public static async Task<string> DoAuth(CookieContainer cookies,
                                                Dictionary<string, string> postHeaders,
                                                StringContent postBody)
        {
            try
            {
                using (var handler = new HttpClientHandler())
                {
                    handler.CookieContainer = cookies;
                    using (var client = new HttpClient(handler, true))
                    {
                        foreach (var key in postHeaders.Keys)
                            client.DefaultRequestHeaders.Add(key, postHeaders[key]);
    
                        var response = await client.PostAsync("https://accounts.dev.example.com/login", postBody);
                        response.EnsureSuccessStatusCode();
                        
                        // This line returns 0 in Domain Controllers, and 2 in all other machines
                        Console.Write(cookies.GetCookies("https://accounts.dev.example.com").Count);
    
                        return await response.Content.ReadAsStringAsync();
                    }
                }
            }
            catch (HttpRequestException e)
            {
                ...
                throw;
            }
        }


    • Edited by MondKin Monday, June 18, 2018 8:54 PM
    Tuesday, June 12, 2018 6:50 PM