How do I manage cookies with HttpClient (C#)?

Cookie management with HttpClient in C# is essential for maintaining session state and handling authentication across HTTP requests. The HttpClient class works with CookieContainer to automatically handle cookies, but you can also manually manipulate them when needed.

Basic Cookie Management Setup

The standard approach uses HttpClientHandler with CookieContainer for automatic cookie handling:

using System;
using System.Net;
using System.Net.Http;
using System.Threading.Tasks;

class Program
{
    static async Task Main(string[] args)
    {
        // Create a CookieContainer to store cookies
        var cookieContainer = new CookieContainer();

        // Configure HttpClientHandler with the cookie container
        var handler = new HttpClientHandler
        {
            CookieContainer = cookieContainer,
            UseCookies = true
        };

        // Create HttpClient with the configured handler
        using var client = new HttpClient(handler);

        // Make requests - cookies are handled automatically
        var response = await client.GetAsync("https://httpbin.org/cookies/set/session/abc123");

        // Cookies from the response are automatically stored
        Console.WriteLine($"Response status: {response.StatusCode}");

        // Subsequent requests will include stored cookies
        var secondResponse = await client.GetAsync("https://httpbin.org/cookies");
        var content = await secondResponse.Content.ReadAsStringAsync();
        Console.WriteLine($"Cookies sent: {content}");
    }
}

Manual Cookie Manipulation

You can manually add, read, and modify cookies using the CookieContainer:

var cookieContainer = new CookieContainer();
var baseUri = new Uri("https://example.com");

// Manually add a cookie
cookieContainer.Add(new Cookie("auth_token", "your_token_here", "/", "example.com"));

// Add a cookie with expiration
var sessionCookie = new Cookie("session_id", "sess_123456")
{
    Domain = "example.com",
    Path = "/",
    Expired = false,
    HttpOnly = true,
    Secure = true,
    Expires = DateTime.Now.AddHours(1)
};
cookieContainer.Add(sessionCookie);

// Read cookies for a specific URI
var cookies = cookieContainer.GetCookies(baseUri);
foreach (Cookie cookie in cookies)
{
    Console.WriteLine($"{cookie.Name}: {cookie.Value} (Expires: {cookie.Expires})");
}

// Remove a specific cookie
var cookieToRemove = new Cookie("auth_token", "", "/", "example.com")
{
    Expired = true
};
cookieContainer.Add(cookieToRemove);

Production-Ready Cookie Management

For production applications, follow these best practices:

public class HttpClientService : IDisposable
{
    private readonly HttpClient _httpClient;
    private readonly CookieContainer _cookieContainer;

    public HttpClientService()
    {
        _cookieContainer = new CookieContainer();

        var handler = new HttpClientHandler
        {
            CookieContainer = _cookieContainer,
            UseCookies = true
        };

        _httpClient = new HttpClient(handler);

        // Set common headers
        _httpClient.DefaultRequestHeaders.Add("User-Agent", 
            "MyApp/1.0 (https://myapp.com)");
    }

    public async Task<string> LoginAsync(string username, string password)
    {
        var loginData = new FormUrlEncodedContent(new[]
        {
            new KeyValuePair<string, string>("username", username),
            new KeyValuePair<string, string>("password", password)
        });

        var response = await _httpClient.PostAsync("https://api.example.com/login", loginData);

        // Cookies are automatically stored after login
        return await response.Content.ReadAsStringAsync();
    }

    public async Task<string> GetProtectedDataAsync()
    {
        // Stored cookies are automatically sent
        var response = await _httpClient.GetAsync("https://api.example.com/protected");
        return await response.Content.ReadAsStringAsync();
    }

    public void ClearCookies()
    {
        // Clear all cookies
        foreach (Cookie cookie in _cookieContainer.GetCookies(_httpClient.BaseAddress))
        {
            cookie.Expired = true;
        }
    }

    public void Dispose()
    {
        _httpClient?.Dispose();
    }
}

Cookie Security and Configuration

Configure cookies with security attributes for production use:

var secureCookie = new Cookie("secure_token", "value123")
{
    Domain = "api.example.com",
    Path = "/",
    Secure = true,      // Only send over HTTPS
    HttpOnly = true,    // Not accessible via JavaScript
    SameSite = SameSiteMode.Strict,  // CSRF protection
    Expires = DateTime.UtcNow.AddMinutes(30)
};

cookieContainer.Add(secureCookie);

Troubleshooting Cookie Issues

Common issues and solutions:

// Check if cookies are being sent
var handler = new HttpClientHandler
{
    CookieContainer = cookieContainer,
    UseCookies = true
};

// Log cookies being sent (for debugging)
var cookies = cookieContainer.GetCookies(new Uri("https://example.com"));
Console.WriteLine($"Sending {cookies.Count} cookies:");
foreach (Cookie cookie in cookies)
{
    Console.WriteLine($"  {cookie.Name}={cookie.Value}");
}

// Verify cookie domain and path match
var testCookie = new Cookie("test", "value", "/api", "example.com");
// This will only be sent to https://example.com/api/* paths

Key Points

• Automatic Management: CookieContainer handles cookies automatically across requests
• Thread Safety: CookieContainer is thread-safe for concurrent requests
• Domain Matching: Cookies are only sent to matching domains and paths
• Reuse HttpClient: Create one HttpClient instance per application lifetime
• Security: Set Secure, HttpOnly, and SameSite attributes for production
• Compliance: Follow GDPR, CCPA, and other privacy regulations when handling cookies

The CookieContainer provides a robust foundation for session management, authentication flows, and maintaining state across HTTP requests in C# applications.