Delete cookies in .net core 2.0

Question

I am working on .Net Core 2.0 MVC Web Application. There is a need to manipulate authentication cookie to set expire time span based on user role. After the expire time span, the user will be logged out of the application if there is no activity. In order to that, I created a Filter which is being called everytime user interacts with the site. In that filter, I am basically reading cookie value, store it in the temp variable, delete existing cookie, and append new cookie with same key and value to the response.

var cookieContent = Request.Cookie[key];
Response.Cookies.Delete(key);
Response.Cookies.Append(new cookie with same name and value);

I am able to create a new cookie with required expire time, and it does work fine. My problem here is, Response.Cookies.Delete(key); doesn't really delete the cookie.

Microsoft documentation says we cannot delete the cookie from the user's pc. so is there any way to delete the cookie from hard-drive? If not, what does Response.Cookies.Delete(cookie); do?

Solution 1

In ASP.NET Core, you can/should use the following method:

    private void DeleteCookies()
    {
        foreach (var cookie in HttpContext.Request.Cookies)
        {
            Response.Cookies.Delete(cookie.Key);
        }
    }

What this does internally is to send 'Set-Cookie' directives in the Http Response Header to instruct the browser to both expire the cookie and clear its value.

• ASP.NET Core source code for ResponseCookies.Delete Method
• MSDN docs here - IResponseCookies.Delete Method

Example response header:

HTTP/1.1 302 Found
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Server: Microsoft-IIS/10.0
Set-Cookie: Cookie1=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; secure; samesite=lax
Set-Cookie: Cookie2=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; secure; samesite=lax
Set-Cookie: Cookie3=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; secure; samesite=lax

Solution 2

You can set expire time for cookie like:

Response.Cookies.Append("cookieName", "", new CookieOptions() {
    Expires = DateTime.Now.AddDays(-1)
});

When the browser get response from the server, it will see that the cookie with name cookieName has expired. Therefore, the browser will delete the cookie.

Solution 3

var Cookieoption1 = new CookieOptions();
Cookieoption1.Path = HttpContext.Request.PathBase;

foreach (var cookieKey in Request.Cookies.Keys)
{
    HttpContext.Response.Cookies.Delete(cookieKey, Cookieoption1);
}

Comments

[Pirate]

Thanks for answer, but this solution works fine in .net framework 4.6, HttpCookie is not available in .NET Core 2.0. After all research, all I found is, we can only get cookie value. We cannot modify cookie like you mentioned above. .Net Core 2.0 doesn't even have _response.Cookies.Set(cookie); Set() extension method.

[Dave Black]

@Dave - see my answer provided below - stackoverflow.com/a/57976991/251267

[Dave Black]

@Pirate - see my answer provided below - stackoverflow.com/a/57976991/251267