[Mono-dev] HttpOnly and Expires not handled by CookieContainer.SetCookies(Uri, string)
tom.philpot at logos.com
Sun Oct 25 01:20:20 EDT 2009
While troubleshooting a web service authentication problem our app is
having, I noticed that CookieContainer.SetCookies(Uri, string) has a few
1) It assumes that the Set-Cookie header only has one cookie in it, since it
does not account for several comma separated cookies (as the MSDN docs
state, and RFC 2109 section 4.2.2)
2) It does not properly set Cookie.Expires or Cookie.HttpOnly (for .NET
2.0). The current implementation will assume that expires=... specifies a
new cookie. Similarly, HttpOnly will cause the CookieContainer to throw an
exception when the cookie is being created since it assumes HttpOnly is a
cookie name with no value.
3) I also noticed most of the CookieContainer tests are marked as
Is CookieContainer really that broken, or am I missing something?
More information about the Mono-devel-list