Authorization Cookie is case sensitive?

Viewed 23

i have a problem with a net web app and Authorization.

I have an area of my site where you need to be authenticated. Some methods that return page (html) and data (json) to the client has [Authorize] attribute.

Signature Example

  [Authorize]
public async Task<JsonResult> GetListaLogin(Guid IDMovScheda)

So when you try to access that area, you're redirected to login page. Login Page Image

Take note of /fakesite lower case

Login Page Authorization will use cookie. Here's the code:

//omitted: checking if login is ok

AuthenticationProperties authProperties = new AuthenticationProperties
{
    AllowRefresh = true ,
    RedirectUri = login.ReturnUrl,
    IsPersistent = login.RememberMe,
};

IEnumerable<Claim> claims = GetUserClaims(loginRow);
ClaimsIdentity identity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
ClaimsPrincipal principal = new ClaimsPrincipal(identity);
await httpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, principal, authProperties);

The code above generate a security cookie. Cookie Image

Take note of /fakesite lower case

When I try to access some data, building the url with uppercase /FakeSite Request Image, the security cookie is not sent in the request and the response is 401 unauthorized.

If i start again but I put from the start /FakeSite, then the security cookie path is /FakeSite and the cookie is sent in the request, all is ok.

I would like to know if Authorization Cookie is case sensitive and how I can avoid this behaviour and always authenticate user, regardless from how you write lower or upper /fakesite

0 Answers
Related