2

I have a Web API controller that authenticates a user and sets a cookie on the response:

// create the response
var response = this.Request.CreateResponse(HttpStatusCode.OK);

var cookie = new CookieHeaderValue(
    FormsAuthentication.FormsCookieName,
    user.GenerateEncryptedTicket(persistent)
);
var host = Request.RequestUri.Host;

// NOTE: this causes failure in Chrome if hosted locally (localhost) 
// http://stackoverflow.com/a/5849409/99373
if (!host.Equals("localhost", StringComparison.OrdinalIgnoreCase))
{
    // are we in a sub-domain
    if (host.Split('.').Length > 2)
    {
        // set the domain as '.domain.com'
        // NOTE: this does not work in chrome
        cookie.Domain = host.Substring(host.LastIndexOf('.', host.LastIndexOf('.') - 1));
    }
    else
    {
        // set the domain as 'domain.com'
        // NOTE: this does not work in chrome either
        cookie.Domain = host;
    }
}

cookie.Expires = DateTime.Now.Add(FormsAuthentication.Timeout);
cookie.Path = "/";
cookie.HttpOnly = true;

// mark the session as authenticated
response.Headers.AddCookies(new CookieHeaderValue[] { cookie });

Unfortunately, this works in IE and Firefox, but not in Chrome. If I comment out the part that sets the cookie.Domain altogether, then Chrome works.

Any ideas why?

Alfero Chingono
  • 2,663
  • 3
  • 33
  • 54

0 Answers0