You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It would be useful to have an option to ignore response cookies; this would allow the ability to accept request data in the case where there are cookies present that throw a CookieException.
Use case:
We have a vendor that is planning a migration from old-domain.com to new-domain.com. For the first phase, they are proxying calls from new-domain.com to old-domain.com, and later will serve directly from new-domain.com (is my understanding).
An API call to api.old-domain.com returns two cookies: one for api.old-domain.com, and one for .old-domain.com; everything works as intended.
An API call to api.new-domain.com returns two cookies: one for api.new-domain.com, and one for .old-domain.com - the latter of which throws a CookieException, due to the domain mismatch. So we lose the request response. I have asked them not to send this invalid (and probably useless?) cookie, but they'd rather say it's my problem, not theirs...
Another potential option: instead of outright ignoring response cookies, there could be an option to ignore cookie exceptions. So there would be a try/catch CookieException around the code in question, and if the option is true, it would swallow the exception (add error details to the response?), and just continue. So you would still get cookies as long as they weren't invalid, but wouldn't fail if one is bad.
I implemented an option to ignore cookie exceptions but then I decided to add tests for the existing flow (no option). And, weirdly, if the wrong domain is assigned to a returned cookie, I don't see any exception.
Would it be possible for you @SteveW-AMain to look at the test (look at CookieTests) and see if it's correct?
Apologies for the lack of feedback; I have been buried in other projects. However, I believe I stumbled over a probable explanation for why you don't see cookie exceptions: dotnet/runtime#26141
It appears these exceptions were fixed/removed in .NET 5, to match how browsers behave. Unfortunately, some of our projects are still targeting .NET Framework 4.8 at this time.
Activity
SteveW-AMain commentedon Jun 13, 2025
Another potential option: instead of outright ignoring response cookies, there could be an option to ignore cookie exceptions. So there would be a try/catch CookieException around the code in question, and if the option is true, it would swallow the exception (add error details to the response?), and just continue. So you would still get cookies as long as they weren't invalid, but wouldn't fail if one is bad.
alexeyzimarev commentedon Nov 12, 2025
I implemented an option to ignore cookie exceptions but then I decided to add tests for the existing flow (no option). And, weirdly, if the wrong domain is assigned to a returned cookie, I don't see any exception.
Would it be possible for you @SteveW-AMain to look at the test (look at CookieTests) and see if it's correct?
SteveW-AMain commentedon Feb 7, 2026
Apologies for the lack of feedback; I have been buried in other projects. However, I believe I stumbled over a probable explanation for why you don't see cookie exceptions:
dotnet/runtime#26141
It appears these exceptions were fixed/removed in .NET 5, to match how browsers behave. Unfortunately, some of our projects are still targeting .NET Framework 4.8 at this time.