ASP.NET fails to correctly handle comma delimited cookies

Question

According to the RFC, individual cookies in the "Cookie" HTTP header may be separated by commas as well as by semicolons. However, ASP.NET does not parse the commas case correctly - it does not count comma as a separator, but considers it just part of the value.

For example If a client sends header Cookie: a=b, c=d, then the ASP.NET application will see just one cookie named "a" with value "b, c=d".

As a special case, the same thing happens when the client sends several Cookie headers (one for each cookie) instead of combining all cookies in one header. From HTTP perspective, this is completely valid, and in such case the effective value of the header should be concatenation of the values of all its instances separated by commas.

Does anybody know a workaround (or maybe a fix?) for this? I absolutely need to get this working, because I don't control the client.

P.S. It is ironic that, according to this thread, the .NET built-in HTTP client's (aka HttpWebRequest) behavior is just the opposite, and also causes problems. :-)

Repairman

Answer 1

I believe the simplest solution to getting the behavior desired (regardless of standards correctness) would be to create an HttpModule that would correctly parse this information from the HttpContext.Request.Headers and place corrected information in HttpContext.Request.Cookies.

Toluol

Yep, this is what I ended up doing. – Repairman

Answer 2

Both RFC 2109 and RFC 2965 are known not to describe reality.

You should have a look at draft-ietf-httpstate-cookie which is a work product of the new IETF httpstate Working Group.

Symptomatic

Answer 3

The version you linked to is obsolete. This HTTP State Management Mechanism document is the latest and greatest and it specifies semi-colons. It does say that commas should be accepted for future compatibility, but this is not required:

Note: For backward compatibility, the separator in the Cookie header is semi-colon (;) everywhere. A server SHOULD also accept comma (,) as the separator between cookie-values for future compatibility.

Vehicle

Oh! Thank you very much for the link. This means, however, that the BlackBerry's browser is not made to standard. I have found that for images (NOTE: only for images!), it sends each cookie in a separate header, which causes ASP.NET (or IIS?) to concatenate them with commas (according to HTTP standard, if I'm not mistaken again), which in turn causes cookies to be parsed incorrectly. Please confirm that my logic is correct here, and I'll send it to RIM for consideration. – Repairman