0

**Using Visual Basic and .Net Framework 4.7.2: **

Setting Cookie in the Response:


Dim token = JwtToken.GenerateToken(expiresAt:=Date.Now.AddHours(2), claims:=tokenIdentity.Claims.ToArray)
Dim authTicket As New FormsAuthenticationTicket(1, newUser.Identity.Name, DateTime.Now, DateTime.Now.AddHours(8), False, token)
Dim authCookie As New HttpCookie("Test", FormsAuthentication.Encrypt(authTicket))
Response.Cookies.Add(authCookie)

Getting the cookie in the next request:

Dim authCookie As HttpCookie = Request.Cookies("Test")

The above code works fine and the authCookie in the next request has the specified value BUT since a larger encrypted token exceeds the cookie size limit (4096), I want to replace the encrypted data with the JwtToken (the token itself is encrypted). See the below code:

Setting Cookie in the Response (BtnLogin_Click):

Dim authTicket As New FormsAuthenticationTicket(1, newUser.Identity.Name, DateTime.Now, DateTime.Now.AddHours(8), False, token)
Dim authCookie As New HttpCookie("Test", token)
Response.Cookies.Add(authCookie)

Getting the cookie in the next request (Application_PostAuthenticateRequest):

Dim authCookie As HttpCookie = Request.Cookies("Test")

The problem is, even though the cookie has been successfully set in the reponse and it can bee seen in the DevTools and the Cookies of the next request, when I am trying to read it,

Dim authCookie As HttpCookie = Request.Cookies("Test")

the result is Nothing (null in VB). I tried to even putting a nomral text like 1234 as the Cookie Value in the response

 authCookie.Value = 1234 

but still I get Nothing in the next request.

I will be grateful if someone shares any idea about what could be the issue, I have looked for many many things and could not find anything that actually fixes the problem.

I have tried making the value hexstring too and expecting anything that could solve the issue.

  • Can you split the data across more than one cookie? Does the JwtToken data belong in the ticket used with forms authentication to identify users? Also, [How can I set the Secure flag on an ASP.NET Session Cookie?](https://stackoverflow.com/q/1442863/1115360) might be useful if you're not doing that already. – Andrew Morton Jan 17 '23 at 17:49

0 Answers0