Postman is not using cookie

15
votes

I've been using Postman in my app development for some time and never had any issues. I typically use it with Google Chrome while I debug my ASP.NET API code.

About a month or so ago, I started having problems where Postman doesn't seem to send the cookie my site issued.

Through Fiddler, I inspect the call I'm making to my API and see that Postman is NOT sending the cookie issued by my API app. It's sending other cookies but not the one it is supposed to send -- see below:

enter image description here

Under "Cookies", I do see the cookie I issue i.e. .AspNetCore.mysite_cookie -- see below:

enter image description here

Any idea why this might be happening?

P.S. I think this issue started after I made some changes to my code to name my cookie. My API app uses social authentication and I decided to name both cookies i.e. the one I receive from Facebook/Google/LinkedIn once the user is authenticated and the one I issue to authenticated users. I call the cookie I get from social sites social_auth_cookie and the one I issue is named mysite_cookie. I think this has something to do with this issue I'm having.

4
asp.netgoogle-chromecookiespostman
Are you testing this locally or on production deploy? – Tarun Lalwani
Both and in both cases, I'm getting the same results. – Sam
Is it deployed on http or https? and is the API call on http or https? – Tarun Lalwani
Locally, it's http but the API that's running on Azure is https. – Sam
I think your issue might be SSL termination and secure cookie. Try not setting the cookie as secure and see if it works – Tarun Lalwani

4 Answers

1
votes

The cookie in question cannot legally be sent over an HTTP connection because its secure attribute is set.

For some reason, mysite_cookie has its secure attribute set differently from social_auth_cookie, either because you are setting it in code...

var cookie = new HttpCookie("mysite_cookie", cookieValue);
cookie.Secure = true;

...or because the service is configured to automatically set it, e.g. with something like this in web.config:

<httpCookies httpOnlyCookies="true" requireSSL="true"/>

The flag could also potentially set by a network device (e.g. an SSL offloading appliance) in a production environment. But that's not very likely in your dev environment.

I suggest you try to same code base but over an https connection. If you are working on code that affects authentication mechanisms, you really really ought to set up your development environment with SSL anyway, or else you are going to miss a lot of bugs, and you won't be able to perform any meaningful pen testing or app scanning for potential threats.

1
votes

You don't need to worry about cookies if you have them on your browser.

You can use your browser cookies by installing Postman Interceptor extension (left side of "In Sync" button).

Postman Interceptor

0
votes

I have been running into this issue recently with ASP.NET core 2.0. ASP.NET Core 1.1 however seems to be working just fine and the cookies are getting set in Postman

0
votes

From what you have describe it seems like, postman is not picking up the cookie you want because it doesn't recognize the name of the cookie or it is still pointing to use the old cookie,

Things you can try:

  1. Undo all the name change and see if it works( just to get to the root of issue)

  2. Rename one cookie and see if it still works, then proceed with other.

I hope by debugging in this way it will take you to the root cause of the issue.