This is for a C# ASP.NET MVC 5 web application, using .NET Framework 4.6.1.
System.Web.HttpCookie has a Path property which is, "the virtual path to transmit with the cookie." The default value of "/" means the server root.
Is that path case sensitive? I think that it should be case insenstive, since the path parts of a URL are case insenstive. [Update: this assumption on my part is wrong. Vide answer below.] However, my experience is proving otherwise.
The web app has a FooBarController, which has a index() method where I fetch the value of a cookie and then render a view.
using System.Web;
using System.Web.Mvc;
public class FooBarController : Controller
{
public ActionResult index( )
{
HttpCookie cookie = HttpContext.Request.Cookies.Get( "page_length" );
if ( cookie != null )
{
// Do something with the page length provided by cookie.Value.
...
}
...
return View( somedata );
}
...
The following is the routing to the methods of that controller. Note that it does not matter if "foobar" or "FooBar" is used in the routing. I have tried both.
public class RouteConfig
{
public static void RegisterRoutes( RouteCollection routes )
{
routes.MapRoute( "", "foobar/index", defaults: new { controller = "foobar", action = "index" } );
routes.MapRoute( "", "foobar/load", defaults: new { controller = "foobar", action = "load", HttpVerbs = HttpVerbs.Post } );
}
}
In a different method of that controller, I store a value in a cookie. Take it as given that the following load() method is correctly called during the lifetime of the web app, and the cookie is correctly stored in the client side browser.
public JsonResult load( TableData data )
{
HttpCookie cookie = new HttpCookie( "page_length" );
cookie.Value = data.PageLength.ToString();
// *** This is the important part. ***
cookie.Path = "/FooBar";
cookie.Expires = DateTime.Now.AddDays( 30 );
HttpContext.Response.Cookies.Add( cookie );
...
}
As mentioned previously, the cookie is successfully stored in the client side browser.
I launch the web app, and navigate to the following URL. Observe that the URL contains the mixed case "FooBar", even though it is not necessary to reach the desired page.
In FooBarController.index(), I can successfully fetch the cookie and use its value.
The cookie is still successfully stored in the client side browser.
I launch the web app, but navigate to the following URL. Observe that the URL contains a lowercase "foobar", which is sufficient to reach the desired page.
In FooBarController.index(), I cannot fetch the cookie. The cookie is hidden from that method, presumably because it is associated only with the mixed case path of "/FooBar".
Store the cookie with a lowercase path of "/foobar".
public JsonResult load( TableData data )
{
HttpCookie cookie = new HttpCookie( "page_length" );
cookie.Value = data.PageLength.ToString();
// *** This is the important part. ***
cookie.Path = "/foobar";
...
I launch the web app, and navigate to the following URL, same as Test 2.
In FooBarController.index(), I can successfully fetch the cookie and use its value.
Why is it necessary for the path of the cookie to be the same case as the path part of the URL for the page being navigated?
Yes, the path of an HttpCookie is case sensitive.
As pointed out in the comments, my assumption that the path part of URL is case insensitive is wrong. Therefore, it is reasonable to expect that the path stored in cookie should be case sensitive.
The routing configuration for a C# ASP.NET web application is more forgiving. When calling RouteCollection.MapRoute(), the URL pattern provided can be in a different case than that of the actual URL used for navigation. The controller and action names provided to MapRoute() can also be in a different case than that of the actual controller class name and method name. Thus, I was misled.
https://www.ibm.com/docs/en/cics-ts/5.2?topic=concepts-components-url says:
The scheme and host components of a URL are not defined as case-sensitive, but the path and query string are case-sensitive. Typically, the whole URL is specified in lowercase.
Most other URL documentation I found may specifically say that other parts, such as the scheme and host, are case insensitive. And since it does not say anything about the case of the path part, I am supposed to infer that it is case sensitive.