locked
Are cookie names case-sensitive? RRS feed

  • Question

  • User863160722 posted

    According to Microsoft:

    Cookie names are NOT case-sensitive.
    msdn.microsoft.com/en-us/library/ms970178.aspx

    However, if I set a cookie with a name of "BasketID", it doesn't overwrite a previous cookie called "basketid" in either IE7 or Firefox 2. The HttpCookieCollection indexer is case-insensitive, so it can only ever return one of these cookies, but both are present if you examine the AllKeys property or access the list by index.

    I've just noticed this problem with an old ASP site which I've upgraded to ASP.NET - cookies set from the old site had a different case, and were overriding cookies set from the new site. So far, the only solution seems to be to iterate through the AllKeys array and manually expire any cookies which don't match the case of the cookie I'm setting.

    Monday, October 15, 2007 4:12 PM

All replies

  • User1564875471 posted

    hi

    cookie names are not case sensitive

     

    Wednesday, October 17, 2007 10:21 AM
  • User863160722 posted

    OK, then explain this:

    CookieTest1.ashx:

    1    <% @ WebHandler language="C#" class="TestCookieHandler1" %>
    2
    3 using System;
    4 using System.Web;
    5
    6 public class TestCookieHandler1 : IHttpHandler
    7 {
    8 public bool IsReusable
    9 {
    10 get { return false; }
    11 }
    12
    13 public void ProcessRequest(HttpContext context)
    14 {
    15 HttpCookie cookie = new HttpCookie("TestCookie", "CookieTest1.ashx");
    16 context.Response.Cookies.Set(cookie);
    17 context.Response.Redirect("CookieTest2.ashx");
    18 }
    19 }

    CookieTest2.ashx:

    1    <% @ WebHandler language="C#" class="TestCookieHandler2" %>
    2
    3 using System;
    4 using System.Web;
    5
    6 public class TestCookieHandler2 : IHttpHandler
    7 {
    8 public bool IsReusable
    9 {
    10 get { return false; }
    11 }
    12
    13 public void ProcessRequest(HttpContext context)
    14 {
    15 HttpCookie cookie = new HttpCookie("testcookie", "CookieTest2.ashx");
    16 context.Response.Cookies.Set(cookie);
    17 context.Response.Redirect("CookieTest3.ashx");
    18 }
    19 }

    CookieTest3.ashx:

    1    <% @ WebHandler language="C#" class="TestCookieHandler3" %>
    2
    3 using System;
    4 using System.IO;
    5 using System.Web;
    6
    7 public class TestCookieHandler3 : IHttpHandler
    8 {
    9 public bool IsReusable
    10 {
    11 get { return false; }
    12 }
    13
    14 public void ProcessRequest(HttpContext context)
    15 {
    16 RenderCookies(context.Response.Output, context.Request.Cookies);
    17 }
    18
    19 private void RenderCookies(TextWriter writer, HttpCookieCollection cookies)
    20 {
    21 writer.Write("<html><head><title>Cookie Test</title></head><body><ul>");
    22
    23 writer.Write("<li><b>Keys:</b> [&quot;");
    24 HttpUtility.HtmlEncode(string.Join("\", \"", cookies.AllKeys), writer);
    25 writer.Write("&quot;]</li>");
    26
    27 for (int index = 0; index < cookies.Count; index++)
    28 {
    29 writer.Write("<li>{0:D}> <b>", index);
    30 HttpUtility.HtmlEncode(cookies.GetKey(index), writer);
    31 writer.Write("</b> = &quot;");
    32 HttpUtility.HtmlEncode(cookies[index].Value, writer);
    33 writer.Write("&quot;</li>");
    34 }
    35
    36 writer.Write("<li><b>TestCookie</b> = &quot;");
    37 HttpUtility.HtmlEncode(cookies["TestCookie"].Value, writer);
    38 writer.Write("&quot;</li>");
    39
    40 writer.Write("<li><b>testcookie</b> = &quot;");
    41 HttpUtility.HtmlEncode(cookies["testcookie"].Value, writer);
    42 writer.Write("&quot;</li>");
    43
    44 writer.Write("</ul></body></html>");
    45 }
    46 }

    Save these three files in a folder on your web-server, and navigate to CookieTest1.ashx. If cookie names are NOT case-sensitive, there should only be one instance of the "TestCookie" cookie, and it should have a value of "CookieTest2.ashx".

    In IE7, Firefox 2 and Opera 9, the final output reads:

    • Keys: ["TestCookie", "testcookie"]
    • 0> TestCookie = "CookieTest1.ashx"
    • 1> testcookie = "CookieTest2.ashx"
    • TestCookie = "CookieTest1.ashx"
    • testcookie = "CookieTest1.ashx"
    Wednesday, October 17, 2007 11:05 AM
  • User-399656762 posted

     Cookie names are case insensitive

    Thursday, October 18, 2007 10:52 AM
  • User863160722 posted

    If cookie names are case insensitive, the example code from my previous post would result in a single cookie, called either "TestCookie" or "testcookie", with a value of "CookieTest2.ashx".

    In IE7, Firefox 2 and Opera 9, it results in two separate cookies - "TestCookie" and "testcookie".

    Therefore, at least in the three major browsers for Windows, cookie names are NOT case insensitive.

    Thursday, October 18, 2007 11:00 AM
  • User1564875471 posted

    hi

    i think when microsoft said

    cookiees is case insensitive , they  meant on the server side ,

    or when you access it from request object like this request.cookies.item("...

     any way , do you still have a problem ?

    regards,

    Thursday, October 18, 2007 11:09 AM
  • User863160722 posted

    The cookie theory link is part of a Javascript book, so I don't see how it can be referring to accessing the cookies on the server.

    Although I've written some code to get around the problem when setting or clearing cookies, there is still no simple way in ASP.NET to access both "TestCookie" and "testcookie" from the Request.Cookies collection; you have to resort to iterating through the list by index.

    This problem also seems to affect "Classic" ASP - the Request.Cookies collection only returns one of the cookie values, whichever case you use to access it.

    Thursday, October 18, 2007 11:24 AM
  • User97111691 posted

    cookies are case sensitive

    Wednesday, October 24, 2007 12:45 AM
  • User1413687170 posted

    I went through this a few months back. Cookies are case sensitive, but in ASP.NET you have loop through cookies that come through as a list\array  or in Classic ASP you are out of luck.
    You can read a small article  I wrote about this.
    http://www.daxmax.com/index.php/2012/05/01/cookie-names-are-case-sensitive/ 

    Monday, September 24, 2012 11:38 PM