ASP.NET fails to correctly handle comma delimited cookies

孤人 提交于 2020-01-13 11:11:10

问题


According to the RFC, individual cookies in the "Cookie" HTTP header may be separated by commas as well as by semicolons. However, ASP.NET does not parse the commas case correctly - it does not count comma as a separator, but considers it just part of the value.

For example If a client sends header Cookie: a=b, c=d, then the ASP.NET application will see just one cookie named "a" with value "b, c=d".

As a special case, the same thing happens when the client sends several Cookie headers (one for each cookie) instead of combining all cookies in one header. From HTTP perspective, this is completely valid, and in such case the effective value of the header should be concatenation of the values of all its instances separated by commas.

Does anybody know a workaround (or maybe a fix?) for this? I absolutely need to get this working, because I don't control the client.

P.S. It is ironic that, according to this thread, the .NET built-in HTTP client's (aka HttpWebRequest) behavior is just the opposite, and also causes problems. :-)


回答1:


I believe the simplest solution to getting the behavior desired (regardless of standards correctness) would be to create an HttpModule that would correctly parse this information from the HttpContext.Request.Headers and place corrected information in HttpContext.Request.Cookies.




回答2:


Both RFC 2109 and RFC 2965 are known not to describe reality.

You should have a look at draft-ietf-httpstate-cookie which is a work product of the new IETF httpstate Working Group.




回答3:


The version you linked to is obsolete. This HTTP State Management Mechanism document is the latest and greatest and it specifies semi-colons. It does say that commas should be accepted for future compatibility, but this is not required:

Note: For backward compatibility, the separator in the Cookie header is semi-colon (;) everywhere. A server SHOULD also accept comma (,) as the separator between cookie-values for future compatibility.



来源:https://stackoverflow.com/questions/2394561/asp-net-fails-to-correctly-handle-comma-delimited-cookies

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!