C# HttpClient gets new SessionID every request

Question

The title explains it mostly. I have declared my HttpClient, HttpClientHandler, and CookieContainer as class variables.

private HttpClient client;
private HttpClientHandler handler;
private CookieContainer cookies;

Then in the form creation I initialize the variables like so

public FrmMain()
{
    InitializeComponent();
    handler = new HttpClientHandler();
    cookies = new CookieContainer();
    handler.AllowAutoRedirect = true;
    handler.UseCookies = true;
    handler.CookieContainer = cookies;
    client = new HttpClient(handler);
    client.DefaultRequestHeaders.Connection.Clear();
    client.DefaultRequestHeaders.ConnectionClose = false;
    client.DefaultRequestHeaders.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36");
}

Later on in the program, when I call the requests, I am able to log in to the url (in this case a device on my local net) just fine. As part of the troubleshooting for this, I started printing the cookie data to the console each time a request is made. When I initially log on, it gives me single cookie, a sessionID. Any subsequent requests that I make using the same client gives me a new sessionID. This causes my requests to get a return code of badRequest, most likely because it is trying to route me back to the login page. I know that I am successfully logging in with the first request because printing the response content gives me the HTML of the index page that I am redirected to upon a successful login. I've tested all the data I'm sending via Postman, where I'm able to do a log in request, then do whatever other requests I need without issue. The only difference between Postman and my program is that in my program I am getting a new sessionID for every request instead of it persisting. Anyone know why my cookies are not persisting despite the client handler, client, and cookie container all being declared in the class scope?

user_7620834 · Answer

It turns out my issue was not a cookie issue. The cookie was supposed to change to a new sessionID after logging in. The sessionID never changes after that. HttpClient was saving the cookie persistently. The issue was with a hidden CSRFToken that I was submitting with the formdata. That changes with each request and while I was doing the steps to get the new one before each POST, I was not actually assigning it.

I'd like to thank Jonathan. If I hadn't jumped back in to try some tweaks to make sure the program was only loading the initializations once, I probably wouldn't be looking in the area where I was neglecting to assign the new CSRFToken.

C# HttpClient gets new SessionID every request

1 Answers