Deleting Cookies (or Managing Cookie Domains) in ASP.NET

I just spent a good few hours wrestling with writing authentication cookies in ASP.NET across different sub-domains. I've done enough SSO installations to know how it should work & what the hiccups are. Today I was reminded of a good lesson. I was writing a Cookie out via Response.Cookies.Add() in 2 sites. The problem was the second site was not overwriting the value from the first. So I tried to delete the cookie. I set the expiration to the past, I removed it from the collection, I tried using Klaus Hartl's jQuery plugin. Nothing was deleting this cookie.

Then I realized what I was doing wrong -- I was setting the Domain in the first instance but NOT in the second. ASP.NET was using different domains in the cookie. What I learned was that the more general, top-level domain was taking priority over the default domain.

Another issue to consider is the fact that Visual Studio 2008 and IIS will read the Cookie values different depending upon their Domain. Let's say we set 3 cookies (with the same name, but different values) with 3 different domains: the top-level domain, a subdomain and the default domain.

Or...



HttpCookie tldCookie = new HttpCookie("Name", "TLD Value")
{
 Domain = "topdomain.com"
};

HttpCookie subDomainCookie = new HttpCookie("Name", "Subdomain Value")
{
 Domain = "subdomain.topdomain.com"
};

HttpCookie defaultCookie = new HttpCookie("Name", "Default (No-Domain) Value");

Response.Cookies.Add(tldCookie);
Response.Cookies.Add(subDomainCookie);
Response.Cookies.Add(defaultCookie);



If we read the "Name" cookie on another page using the ASP.NET Development Server -- what should the value be?



HttpCookie cookie = Request.Cookies["Name"];
if (cookie == null) return;
Response.Write(cookie.Value);



...this will write Default (No-Domain) Value as the value while running locally. If you run the same page on subdomain.topdomain.com it will return TLD Value.

Top-Level Domains will take precedence over other domains. Moreover, the subdomain cookie will be there (if you use the WebDev toolbar + View Cookies); however, it is not readable within the Response.Cookies collection.



Comments

Post a Comment

Popular posts from this blog

Fluent NHibernate - Incorrect syntax near the keyword 'Group'

I have to share this. I spent a good amount of time searching around Fluent NHibernate for a way to escape columns in the generated SQL while still using AutoMapping. My initial configuration looked like: Fluently.Configure() .Database(MsSqlConfiguration.MsSql2005.ConnectionString( c => c.Is(ConfigurationManager.ConnectionStrings["Something"].ConnectionString))) .Mappings(x => x.AutoMappings.Add(AutoPersistenceModel.MapEntitiesFromAssemblyOf () .WithSetup(convention => { convention.FindIdentity = p => p.Name == p.DeclaringType.Name + "Id"; convention.GetComponentColumnPrefix = type => type.Name + "Id"; } ) .BuildSessionFactory() This works great, but I had a property in my class (SomeType) that is called Group. This was causing the SqlException: Incorrect syntax near the keyword 'Group' (others would be like: Incorrect syntax near the keyword 'User' or Incorrect syntax near the keyword ...
Read more

Fluent NHibernate + Encrypting Values

I recently created two CLR User Defined Functions for SQL Server 2005 (written in C#) to decrypt & encrypt a given string (based on a hard-coded key). select dbo.EncryptString('Testing') -- Returns: Fjfds243qcm43fsdj2343== select dbo.DecryptString('Fjfds243qcm43fsdj2343==') -- Returns: Testing Pretty simple stuff. This will allow the user with enough access to pull encrypted data out of the database and provide the ability to restrict decryption to other SQL users. Now to implement this in code... Because it's awesome, Fluent NHibernate has a method called FormulasIs that assists in building out values using SQL. public class User { public virtual int Id { get; set; } public virtual DateTime DateOfBirth { get; set; } } public sealed class UserMap : ClassMap { public UserMap() { WithTable("dbo.[User]"); Id(x => x.Id, "[ID]"); Map(x => x.DateOfBirth, "DOB").FormulaIs("dbo.DecryptString(DOB)"); ...
Read more

MapReduce in C# using Task Parallel Library

Back in August I starting playing with a C# implementation of Google's MapReduce algorithm. The implementation was based on something Stephan Brenner did, although I completely refactored it. Today I added a little bit of logic to split up the actual execution of Map & Reduce in this implementation using the Task Parallel Library in .NET 4.0. Check out the source code for MapReduce in C# on GitHub. Below is an excerpt from the Tests on how to implement the library. Counting Words in Files public static List<KeyValuePair<string, int>> Map(FileInfo document, string text) { var items = text.Split('\n', ' ', '.', ',','\r'); return items.Select(item => new KeyValuePair<string, int>(item, 1)).ToList(); } public static List<int> Reduce(string word, List<int> wordCounts) { if (wordCounts == null) return null; var result = new List<int> { 0 }; foreach (var value in wordC...
Read more