ASP.NET 无法正确处理逗号分隔的 cookie
根据 RFC，“Cookie”HTTP 标头中的各个 Cookie 可以通过逗号以及分号。但是，ASP.NET 无法正确解析逗号大小写 - 它不会将逗号视为分隔符，而是将其视为值的一部分。
例如 如果客户端发送标头 Cookie: a=b, c=d，则 ASP.NET 应用程序将仅看到一个名为“a”且值为“b, c=d”的 cookie。
作为一种特殊情况，当客户端发送多个 Cookie 标头（每个 cookie 一个）而不是将所有 cookie 组合在一个标头中时，也会发生同样的情况。从 HTTP 的角度来看，这是完全有效的，在这种情况下，标头的有效值应该是用逗号分隔的所有实例的值的串联。
有人知道这个问题的解决方法（或者可能是修复程序吗？）？我绝对需要让它发挥作用，因为我无法控制客户。
PS 具有讽刺意味的是，根据 此线程，.NET 内置 HTTP 客户端（又名 HttpWebRequest）的行为恰恰相反，也会导致问题。 :-)
According to the RFC, individual cookies in the "Cookie" HTTP header may be separated by commas as well as by semicolons. However, ASP.NET does not parse the commas case correctly - it does not count comma as a separator, but considers it just part of the value.
For example
If a client sends header Cookie: a=b, c=d, then the ASP.NET application will see just one cookie named "a" with value "b, c=d".
As a special case, the same thing happens when the client sends several Cookie headers (one for each cookie) instead of combining all cookies in one header. From HTTP perspective, this is completely valid, and in such case the effective value of the header should be concatenation of the values of all its instances separated by commas.
Does anybody know a workaround (or maybe a fix?) for this? I absolutely need to get this working, because I don't control the client.
P.S. It is ironic that, according to this thread, the .NET built-in HTTP client's (aka HttpWebRequest) behavior is just the opposite, and also causes problems. :-)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
众所周知，RFC 2109 和 RFC 2965 都没有描述现实。
您应该查看 draft-ietf-httpstate-cookie< /a> 这是新的 IETF httpstate 工作组的工作产品。
Both RFC 2109 and RFC 2965 are known not to describe reality.
You should have a look at draft-ietf-httpstate-cookie which is a work product of the new IETF httpstate Working Group.
您链接到的版本已过时。这个 HTTP 状态管理机制文档是最新、最好的，它指定了分号。它确实说应该接受逗号以实现未来的兼容性，但这不是必需的：
The version you linked to is obsolete. This HTTP State Management Mechanism document is the latest and greatest and it specifies semi-colons. It does say that commas should be accepted for future compatibility, but this is not required:
我相信获得所需行为（无论标准正确性如何）的最简单解决方案是创建一个 HttpModule，它将正确解析来自 HttpContext.Request.Headers 的信息并将更正后的信息放入 HttpContext.Request.Cookies 中。
I believe the simplest solution to getting the behavior desired (regardless of standards correctness) would be to create an HttpModule that would correctly parse this information from the HttpContext.Request.Headers and place corrected information in HttpContext.Request.Cookies.