Delete cookies in .net core 2.0

时光毁灭记忆、已成空白 提交于 2019-12-11 13:26:20

问题


I am working on .Net Core 2.0 MVC Web Application. There is a need to manipulate authentication cookie to set expire time span based on user role. After the expire time span, the user will be logged out of the application if there is no activity. In order to that, I created a Filter which is being called everytime user interacts with the site. In that filter, I am basically reading cookie value, store it in the temp variable, delete existing cookie, and append new cookie with same key and value to the response.

var cookieContent = Request.Cookie[key];
Response.Cookies.Delete(key);
Response.Cookies.Append(new cookie with same name and value);

I am able to create a new cookie with required expire time, and it does work fine. My problem here is, Response.Cookies.Delete(key); doesn't really delete the cookie.

Microsoft documentation says we cannot delete the cookie from the user's pc. so is there any way to delete the cookie from hard-drive? If not, what does Response.Cookies.Delete(cookie); do?


回答1:


You can set expire time for cookie like:

Response.Cookies.Append("cookieName", "", new CookieOptions() {
    Expires = DateTime.Now.AddDays(-1)
});

When the browser get response from the server, it will see that the cookie with name cookieName has expired. Therefore, the browser will delete the cookie.




回答2:


In ASP.NET Core, you can/should use the following method:

    private void DeleteCookies()
    {
        foreach (var cookie in HttpContext.Request.Cookies)
        {
            Response.Cookies.Delete(cookie.Key);
        }
    }

What this does internally is to send 'Set-Cookie' directives in the Http Response Header to instruct the browser to both expire the cookie and clear its value.

  • ASP.NET Core source code for ResponseCookies.Delete Method
  • MSDN docs here - IResponseCookies.Delete Method

Example response header:

HTTP/1.1 302 Found
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Server: Microsoft-IIS/10.0
Set-Cookie: Cookie1=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; secure; samesite=lax
Set-Cookie: Cookie2=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; secure; samesite=lax
Set-Cookie: Cookie3=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; secure; samesite=lax



回答3:


Clearing the cookies of the response doesn't instruct the browser to clear the cookie, it merely does not send the cookie back to the browser. To instruct the browser to clear the cookie you need to tell it the cookie has expired, e.g.

public static void Clear(string key)
{
    var httpContext = new HttpContextWrapper(HttpContext.Current);
    _response = httpContext.Response;

    HttpCookie cookie = new HttpCookie(key) 
        { 
            Expires = DateTime.Now.AddDays(-1) // or any other time in the past
        };
    _response.Cookies.Set(cookie);
}

Just to add something else I also pass the value back as null e.g.

 public static void RemoveCookie(string cookieName)
    {
        if (HttpContext.Current.Response.Cookies[cookieName] != null)
        {
            HttpContext.Current.Response.Cookies[cookieName].Value = null;
            HttpContext.Current.Response.Cookies[cookieName].Expires = DateTime.Now.AddMonths(-1);
        }
    }


来源:https://stackoverflow.com/questions/48918820/delete-cookies-in-net-core-2-0

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!