Question

I’m having troubles with HttpWebRequest/HttpWebResponse and cookies/CookieContainer/CookieCollection. The thing is, if the web server does not send/use a ‘path’ in the cookie, Cookie.Path equals the path-part of the request URI instead of ‘/’ or being empty in my application. Therefore, those cookies do not work for the whole domain, which it actually does in proper web browsers. Any ideas how to solve this issue?

Thanks in advance

Answer 1

Ah, I see what you mean. Generally what browsers really do is take the folder containing the document as the path; for ‘/login.php’ that would be ‘/’ so it would effectively work across the whole domain. ‘/potato/login.php’ would be limited to ‘/potato/’; anything with trailing path-info parts (eg. ‘/login.php/’) would not work.

In this case the Netscape spec could be considered wrong or at least misleading in claiming that path defaults to the current document path… depending on how exactly you read ‘path’ there. However the browser behaviour is consistent back as far as the original Netscape version. Netscape never were that good at writing specs…

If .NET’s HttpWebRequest is really defaulting CookieContainer.Path to the entire path of the current document, I’d file a bug against it.

Unfortunately the real-world behaviour is not actually currently described in a standards document… there is RFC 2965, which does get the path thing right, but makes several other changes not representative of real-world browser behaviour, so that’s not wholly reliable either. 🙁