Copy the cookies to the proxy request

[daniel4wong]

Hi, i found that the proxy request fail to have the cookies from the original request

I have a fix for that by using CookieContainer in HttpClient
Please have a look in my fork, which I only update the ProxyMiddleware.cs

Please check and thank you =]

[Steinblock]

@daniel4wong

There are some problems in your solution

Cookies are set too early

Since SetProxyRequestHeaders is called before matchedRule.Modifier.Invoke(proxyRequest, context.Authentication.User); the cookies are set for the old baseAddress in _cookieContainer.Add(baseAddress, new Cookie(cookie.Key, cookie.Value)); and where not send to my proxied host.

Only a single CookieContainer instance

Since _cookieContainer is set in the .ctor it will be reused. (First request sets cookie A, Second request sets cookie B -> proxied host will receive cookie A and B for the second request), so cookieContainer.SetCookies(baseAddress, cookieHeader) would be better but even then this might lead to unpredicted behaviour since this might not be thread safe.

Cookies are still ignored if BackChannelMessageHandler is used

If someone uses the ProxyOptions.BackChannelMessageHandler property, cookies are set but never used.

Solution

My first attempt was to create a new HttpClient for every request and assign a new CookieContainer. This worked pretty well but is propably a bit slower because of the overhead.

The thing is that the cookie header is already set in SetProxyRequestHeaders but is not send to the client if I don't set a CookieContainer but I figured out that setting handler.UseCookies = false will be sufficient. In that case the header is send.

@RoadTrain

This should be a property in ProxyOptions but the default should be to not send the cookies because this might leak information if you don't own the proxied host (This might apply for some other headers as well, i.e. auth etc.). In my case this is a desired behaviour since I want to pass my forms auth cookie.

Anyway, I am not creating a merge request since there is a good workaround without changing the code.

var proxyOptions = new ProxyOptions(rules);
proxyOptions.BackChannelMessageHandler = new HttpClientHandler
{
    AllowAutoRedirect = proxyOptions.FollowRedirects,
    UseProxy = proxyOptions.UseExternalProxy,
    Proxy = proxyOptions.ExternalProxy,
    PreAuthenticate = proxyOptions.ExternalProxyPreAuthenticate,
    UseCookies = false,
};