ASP.NET 6 Core uses cookies to maintain user session state and for authentication purposes. ASP.NET Core uses the Microsoft.AspNetCore.Http.Cookie middleware to work with cookies. This middleware can be used to set, get, and delete cookies.

In this programming tutorial, we will be discussing cookies in ASP.NET 6 Core. We will cover what a cookie is, how to create and manipulate a cookie, and some of the security implications to keep in mind when working with cookies in ASP.NET.

What is a Cookie in ASP.NET?

In basic terms, a cookie is a smaller piece of information stored on a computer, usually as a text file. It keeps the information about you and your activities, like your preferred language or country. Cookies can also help web developers track user behaviour to improve our services and web sites.

To better understand this, consider the following example. If you have been performing searches for one particular type of product or service, but then start searching for something different, as a webmaster we might need to show more relevant search results to help get you closer to finding what you want.

Additionally, if you visit a website and add items to your shopping cart, but do not complete the purchase, the website will “remember” what you added to your cart so that when you come back later, your shopping cart will still contain those items.

Cookies allow web developers to customize content based on how people use our site — for example, by recognizing when they return after logging out of their account. This customization allows us to make better decisions and understand how visitors interact with our content to optimize future experiences accordingly.

What are the Different Types of Cookies?

Basically, cookies can be divided into two types, namely session cookies and persistent cookies. When you visit a website, session cookies are stored on your computer only for the duration of your visit. A session cookie is destroyed when you leave your browser or move away from a web page.

As the name suggests, persistent cookies dwell on your computer even after you have closed your web browser. Persistent cookies can store information accessible across multiple sessions. Generally, these cookies store login information or preferences.

How to Create a Cookie in ASP.NET

Creating a cookie in ASP.NET Core is simple. First, create a new CookieOptions object as shown in the code example given below:

var cookieOptions = new CookieOptions(); 

Next, set the expiration date and path of the cookie, as shown below:

cookieOptions.Expires = DateTime.Now.AddDays(1);
cookieOptions.Path = "/"; 

Lastly, add the cookie to the response object, as shown below:

Response.Cookies.Append("SomeCookie", "SomeValue", cookieOptions);

You can view your web browser’s cookie cache to determine whether a cookie has been written correctly.

How to Read a Cookie in ASP.NET

In ASP.NET 6 Core, you can take advantage of the Request object’s Cookies collection to read a cookie. This collection is an instance of the HttpCookieCollection class. To read a cookie, use the indexer of this class to retrieve the HttpCookie object for a given cookie name:

var cookie = Request.Cookies["cookieName"]; 

If the cookie does not exist, the indexer returns null. You can also use the Cookies collection’s Get method to retrieve a cookie:

var cookie = Request.Cookies.Get("cookieName"); 

If the cookie does not exist, this method returns null as well.

How to Update a Cookie in ASP.NET

To update a cookie in ASP.NET 6 Core, you will need to retrieve the cookie from the Request object using the following piece of code:

var cookie = Request.GetCookies("cookieName"); 

You can then modify the cookie value as desired. Lastly, you can write the updated cookie back to the Response object using the SetCookie method, as shown below:

Response.SetCookie(cookie);

Delete a Cookie in ASP.NET

When using ASP.NET Core 6, there are two ways to delete a cookie. The first way is to use the Delete method of the Cookie object as shown below:

Response.Cookies.Delete(somekey); 

The second way is to use the Response object and set the Expires property of the cookie to a date in the past as shown in the ASP.NET code example below:

Response.Cookies["cookieName"].Expires = DateTime.Now.AddDays(-1);

You can use the Clear method to clear all cookies as shown here:

Response.Cookies.Clear();

How to Access Cookies in the Controller Method

To access cookies in the Controller method, developers should register an instance of type IHttpContextAccessor in the Program.cs file as shown below:

builder.Services.AddSingleton<IHttpContextAccessor, HttpContextAccessor>();

To read or write cookie data in your controller methods, you will need to inject an instance of type IHttpContextAccessor in the constructor of your controller. The code example given below illustrates how this can be achieved:

public class SomeController : Controller
{
  private readonly IHttpContextAccessor _httpContextAccessor;
  public SomeController(IHttpContextAccessor httpContextAccessor)
  {
     this._httpContextAccessor = httpContextAccessor;
  }   
  //Write your action methods here
}

You can now use the following piece of code to access the Cookies object in your controller methods:

CookieOptions options = new CookieOptions();
options.Expires = DateTime.Now.AddSeconds(30);
_httpContextAccessor.HttpContext.Response.Cookies.Append("someKey", "someValue", options);

Final Thoughts on Cookies in ASP.NET

If you would like to use cookies to store sensitive information, it is important to ensure that your cookies are properly secured using SSL/TLS encryption. In this web development tutorial, we examined how programmers can work with cookies in ASP.NET 6 Core. We also explored the different types of cookies and how to create, read, and update them programmatically.

We’ll start with an example .NET 6 CRUD API from a tutorial I posted recently, it uses the EF Core InMemory db provider by default for testing, we’ll update it to connect to a SQL Server database and run EF Core migrations to auto generate the database and tables from code. 

Requirements!

To follow the steps in this tutorial you’ll need the following:

• .NET SDK – includes the .NET runtime and command line tools.
• Visual Studio Code – code editor that runs on Windows, Mac and Linux. If you have a different preferred code editor that’s fine too.
• C# extension for Visual Studio Code – adds support to VS Code for developing .NET applications.
• SQL Server – you’ll need access to running SQL Server instance for the API to connect to, it can be remote (e.g. Azure, AWS etc) or on your local machine. The Express edition of SQL Server is available for free at https://www.microsoft.com/sql-server/sql-server-downloads.

Download & Run the example .NET 6 API

Follow these steps to download and run the .NET 6 CRUD API on your local machine with the default EF Core InMemory database:

1. Download or clone the tutorial project code from https://github.com/cornflourblue/dotnet-6-crud-api
2. Start the api by running dotnet run from the command line in the project root folder (where the WebApi.csproj file is located), you should see the message Now listening on: http://localhost:4000.
3. You can test the API directly with a tool such as Postman.

Starting in debug mode

You can also start the application in debug mode in VS Code by opening the project root folder in VS Code and pressing F5 or by selecting Debug -> Start Debugging from the top menu, running in debug mode allows you to attach breakpoints to pause execution and step through the application code.

Update .NET 6 API to use SQL Server

Add SQL Server database provider from NuGet

Run the following command from the project root folder to install the EF Core database provider for SQL Server from NuGet:

dotnet add package Microsoft.EntityFrameworkCore.SqlServer

Add connection string to app settings

Open the appsettings.json file and add the entry "ConnectionStrings" with a child entry for the SQL Server connection string (e.g. "WebApiDatabase"), the connection string should be in the format "Data Source=[DB SERVER URL]; Initial Catalog=[DB NAME]; User Id=[USERNAME]; Password=[PASSWORD]", or to connect with the same account that is running the .NET API use the connection string format "Data Source=[DB SERVER URL]; Initial Catalog=[DB NAME]; Integrated Security=true".

When EF Core migrations generates the database, the Initial Catalog value will be the name of the database created in SQL Server.

The updated appsettings.json file with the connection string should look something like this:

{
    "ConnectionStrings": {
        "WebApiDatabase": "Data Source=localhost; Initial Catalog=dotnet-6-crud-api; User Id=testUser; Password=testPass123"
    },
    "Logging": {
        "LogLevel": {
            "Default": "Information",
            "Microsoft.AspNetCore": "Warning"
        }
    }
}

Update Data Context to Use SQL Server

The DataContext class located at /Helpers/DataContext.cs is used for accessing application data through Entity Framework. It derives from the Entity Framework DbContext class and has a public Users property for accessing and managing user data.

Update the OnConfiguring() method to connect to SQL Server instead of an in memory database by replacing options.UseInMemoryDatabase("TestDb"); with options.UseSqlServer(Configuration.GetConnectionString("WebApiDatabase"));.

The updated DataContext class should look like this:

namespace WebApi.Helpers;

using Microsoft.EntityFrameworkCore;
using WebApi.Entities;

public class DataContext : DbContext
{
    protected readonly IConfiguration Configuration;

    public DataContext(IConfiguration configuration)
    {
        Configuration = configuration;
    }

    protected override void OnConfiguring(DbContextOptionsBuilder options)
    {
        // connect to sql server with connection string from app settings
        options.UseSqlServer(Configuration.GetConnectionString("WebApiDatabase"));
    }

    public DbSet<User> Users { get; set; }
}

Create SQL Database from code with EF Core Migrations

Install dotnet ef tools

The .NET Entity Framework Core tools (dotnet ef) are used to generate EF Core migrations, to install the EF Core tools globally run dotnet tool install -g dotnet-ef, or to update run dotnet tool update -g dotnet-ef. For more info on EF Core tools see https://docs.microsoft.com/ef/core/cli/dotnet

Add EF Core Design package from NuGet

Run the following command from the project root folder to install the EF Core design package, it provides cross-platform command line tooling support and is used to generate EF Core migrations:

dotnet add package Microsoft.EntityFrameworkCore.Design

Generate EF Core migrations

Generate new EF Core migration files by running the command dotnet ef migrations add InitialCreate from the project root folder (where the WebApi.csproj file is located), these migrations will create the database and tables for the .NET Core API.

Execute EF Core migrations

Run the command dotnet ef database update from the project root folder to execute the EF Core migrations and create the database and tables in SQL Server.

Check SQL Server and you should now see your database with the tables Users and __EFMigrationsHistory.

Restart .NET 6.0 CRUD API

Stop and restart the API with the command dotnet run from the project root folder, you should see the message Now listening on: http://localhost:4000 and the API should now be connected to SQL Server.