System.Net.Http.HttpClientHandler.CookieContainer is empty in a UWP app when cookies are set on 302 redirect response

[pphadke-zz]

When the System.Net.Http.HttpClient class - with a HttpClientHandler is used from a UWP, the response cookie collection returned is empty. This happens when the cookies are being set on a 302 redirect response.

When you collect a network trace, you should notice the below request/response pattern:

Request:

GET location HTTP/1.1
Host: host
Connection: Keep-Alive
...other request headers

Response:

HTTP/1.1 302 Object moved
Set-Cookie: name=value;
Location: redirect location
...other response headers

The problem happens because the default behavior of the HttpClientHandler is to perform auto-redirection. With this setting, the .NET layer does not get to see the cookies in the redirect response leading to the buggy behavior.

[pphadke-zz]

To workaround this issue, you can use either of the two approaches:

1.) You can continue to use the System.Net.Http.HttpClient class, but then you also have to turn off the default auto-redirection property of the HttpClientHandler (HttpClientHandler.AllowAutoRedirect = false) and perform the redirection manually (instead of automatically). When you do this, the HTTP 302 response you receive should populate the Cookie collection correctly.

2.) Use the WinRT Windows.Web.Http.HttpClient class to handle this scenario. Typically, you will use code similar to this:

    private async void buttonWWH_Click(object sender, RoutedEventArgs e)
    {
        Windows.Web.Http.Filters.HttpBaseProtocolFilter filter = new Windows.Web.Http.Filters.HttpBaseProtocolFilter();
        Windows.Web.Http.HttpClient http = new Windows.Web.Http.HttpClient(filter);
        var req = new Windows.Web.Http.HttpRequestMessage(Windows.Web.Http.HttpMethod.Get, new Uri(txtUri.Text));

        var result = await http.SendRequestAsync(req);
        // consume the response
        var responseText = result.StatusCode.ToString() + await result.Content.ReadAsStringAsync();

        // get the cookies of the request that elicited this response and display
        var responseCookies = filter.CookieManager.GetCookies(result.RequestMessage.RequestUri).Cast<Windows.Web.Http.HttpCookie>().ToArray();

        string cookiesString = "";
        for (int i = 0; i < responseCookies.Length; i++)
        {
            cookiesString = cookiesString + responseCookies[i].Name + "=" + responseCookies[i].Value + Environment.NewLine;
        }
        // check to see the response cookies
        var responseCookies = cookiesString == ""? "Cookie collection is empty.": cookiesString;
    }

[GeertvanHorrik]

This is exactly what I encountered today with the latest System.Net.Http (4.1.0. I think). It happens in a UWP app. I guess the issue is that the Location header is handled before parsing the cookie.

As @pphadke explains, the workaround is:

1. Create a separate HttpClient with a custom HttpClientHandler, set EnableAutoRedirect to true
2. Request the site you wish to retrieve all cookies for and make sure to check for the Location header since you need to redirect yourself (until the Location header is null).
   3. Then create a secondary (final) HttpClientHandler and set the CookieContainer to be the instance of the first HttpClientHandler.
3. Finally create a new HttpClient, this contains all the cookies and you can start using the final HttpClient and it deals with cookies the same way as a browser does.

[ghost]

Has this been fixed?

[davidsh]

Has this been fixed?

It has not been fixed yet. The fix would be part of our UAP/UWP work for .NET Core 2.1 release.

[ghost]

By the way, this doesn't just affect windows UWP apps, this is broken on macOS and Xamarin.Forms with PCL

[davidsh]

By the way, this doesn't just affect windows UWP apps, this is broken on macOS and Xamarin.Forms with PCL

cc: @stephentoub