8 ms·

>With .NET Core 3.0, we’re at the point where we’ve ported all technologies that are required for modern workloads .net HttpClient is based on outdated cookies

>With .NET Core 3.0, we’re at the point where we’ve ported all technologies that are required for modern workloads .net HttpClient is based on outdated cookies RFC, RFC6265(that is 8 years old) is yet to be supported [1]. And what can you do today without good http library? [1] https://github.com/dotnet/corefx/issues/29651 https://github.com/dotnet/corefx/issues/29651

manigandham 7y ago
HttpClient is fast and efficient, and the built-in cookie container handles all the standard functionality, although many users just read and handle the cookie header directly. This RFC seems to be all about rejecting certain cookies under some very specific security rules. How impactful is this really? Is this affecting your app somehow?
- merb 7y ago
  especially since you need to enable the cookie container functionality manually and you can override it by yourself
  - Dolores12 7y ago
    or use different language with good library that support 8-year old RFC.
    - manigandham 7y ago
      C# is a language but .NET is a runtime and standard library. If this issue is really such a problem, you can use any of the dozens of open-source libraries available or just implement your own cookie container that follows this RFC in about a day. It sounds like you're picking on a strange issue to disparage .NET without any real experience in it.
      - Dolores12 7y ago
        No, i just didn't like the wording in the original post mentioning all 'modern workloads' , while ubiquitous thing like cookies in httpclient is still not according to 8 year old standard. Does it make any sense now?
        manigandham 7y ago
        Modern workloads refers to the kind of applications commonly built today, like http/json/grpc webservices running in containers. And yes the HttpClient is modern. Your entire argument so far has been a single RFC issue that is labeled up-for-grabs because it's so minor and doesn't really affect anyone. Claiming the http functionality and the whole stack isn't modern because of it just doesn't add up.
        merb 7y ago
        especially since cookiejar is kinda useless. you can't use it with more than a single server, anyway..
        saberience 7y ago
        You are being over the top and quite frankly ridiculous. I've been using .Net Core in production since its initial release while working for a famous games company (which you probably heard of) and now for a multi billion dollar FinTech firm, and the whole time I have been using HttpClient or libraries using HttpClient for connecting to services/apis. If your whole reason for not using .Net Core is based around this weird and honestly unimportant edge case, all that tells me is that you have a strange bias against the framework for some other reason and looking to nitpick.
        nbevans 7y ago
        That "8 year old standard" you linked to is just a draft and proposed standard. Nobody implements draft specs in production grade libraries/frameworks. Especially not Microsoft.
- Dolores12 7y ago
  Well, you expect http library to be as good as everywhere else.. like python requests. When library is not updated due to app compatibility issues i would not call it modern. It is good enough for basic use, tho.
  - manigandham 7y ago
    HttpClient supports http2, the latest protocol features, has been rewritten in managed code with sockets, and includes advanced handling to balance connection lifetimes with DNS updates. It's about as modern as it gets and we run 10 billion requests per day through this code without issue. How does a lack of support for an RFC (which is still being revised) that outlines where a cookie should not be accepted in edge cases mean the HTTP library is not modern? Where are you running into this issue in a real app?
    - Dolores12 7y ago
      > Where are you running into this issue in a real app? I had discovered few bugs in cookies handling myself, compared behavior to competitors and moved on. If cookies handling is not enough, i came across inconsistent behavior on different platforms: on Windows it uses WinHttpHandler, on Linux its curl lib(if i remember correctly). And they both handle edge cases differently.
      - manigandham 7y ago
        HttpClient uses sockets in managed code since .NET Core 2.1 which was released in Oct 2018: https://docs.microsoft.com/en-us/dotnet/core/whats-new/dotnet-core-2-1#sockets-improvements https://docs.microsoft.com/en-us/dotnet/core/whats-new/dotne... There shouldn't be any platform issues unless you're using an even older version or manually forcing it. What bugs in cookie handling did you encounter? This is very widely used code and the team is responsive so if you can document the issues then they can help.
    - Rapzid 7y ago
      Yeah, comparing it to requests which is: A.) Not even stdlib and B.) Doesn't support async/await Is an odd choice.
romanovcode 7y ago
The HTTP library is super easy to use and is very fast. I would not say that this issue makes the library bad.
- sebazzz 7y ago
  Agreed. You could also use Curl bindings for .NET as an alternative.
victorNicollet 7y ago
Using cookies in HttpClient strikes me as a rare situation.

manigandham 7y ago

HttpClient is fast and efficient, and the built-in cookie container handles all the standard functionality, although many users just read and handle the cookie header directly. This RFC seems to be all about rejecting certain cookies under some very specific security rules. How impactful is this really? Is this affecting your app somehow?

merb 7y ago
especially since you need to enable the cookie container functionality manually and you can override it by yourself
- Dolores12 7y ago
  or use different language with good library that support 8-year old RFC.
  - manigandham 7y ago
    C# is a language but .NET is a runtime and standard library. If this issue is really such a problem, you can use any of the dozens of open-source libraries available or just implement your own cookie container that follows this RFC in about a day. It sounds like you're picking on a strange issue to disparage .NET without any real experience in it.
    - Dolores12 7y ago
      No, i just didn't like the wording in the original post mentioning all 'modern workloads' , while ubiquitous thing like cookies in httpclient is still not according to 8 year old standard. Does it make any sense now?
      - manigandham 7y ago
        Modern workloads refers to the kind of applications commonly built today, like http/json/grpc webservices running in containers. And yes the HttpClient is modern. Your entire argument so far has been a single RFC issue that is labeled up-for-grabs because it's so minor and doesn't really affect anyone. Claiming the http functionality and the whole stack isn't modern because of it just doesn't add up.
        merb 7y ago
        especially since cookiejar is kinda useless. you can't use it with more than a single server, anyway..
      - saberience 7y ago
        You are being over the top and quite frankly ridiculous. I've been using .Net Core in production since its initial release while working for a famous games company (which you probably heard of) and now for a multi billion dollar FinTech firm, and the whole time I have been using HttpClient or libraries using HttpClient for connecting to services/apis. If your whole reason for not using .Net Core is based around this weird and honestly unimportant edge case, all that tells me is that you have a strange bias against the framework for some other reason and looking to nitpick.
      - nbevans 7y ago
        That "8 year old standard" you linked to is just a draft and proposed standard. Nobody implements draft specs in production grade libraries/frameworks. Especially not Microsoft.
Dolores12 7y ago
Well, you expect http library to be as good as everywhere else.. like python requests. When library is not updated due to app compatibility issues i would not call it modern. It is good enough for basic use, tho.
- manigandham 7y ago
  HttpClient supports http2, the latest protocol features, has been rewritten in managed code with sockets, and includes advanced handling to balance connection lifetimes with DNS updates. It's about as modern as it gets and we run 10 billion requests per day through this code without issue. How does a lack of support for an RFC (which is still being revised) that outlines where a cookie should not be accepted in edge cases mean the HTTP library is not modern? Where are you running into this issue in a real app?
  - Dolores12 7y ago
    > Where are you running into this issue in a real app? I had discovered few bugs in cookies handling myself, compared behavior to competitors and moved on. If cookies handling is not enough, i came across inconsistent behavior on different platforms: on Windows it uses WinHttpHandler, on Linux its curl lib(if i remember correctly). And they both handle edge cases differently.
    - manigandham 7y ago
      HttpClient uses sockets in managed code since .NET Core 2.1 which was released in Oct 2018: https://docs.microsoft.com/en-us/dotnet/core/whats-new/dotnet-core-2-1#sockets-improvements https://docs.microsoft.com/en-us/dotnet/core/whats-new/dotne... There shouldn't be any platform issues unless you're using an even older version or manually forcing it. What bugs in cookie handling did you encounter? This is very widely used code and the team is responsive so if you can document the issues then they can help.
  - Rapzid 7y ago
    Yeah, comparing it to requests which is: A.) Not even stdlib and B.) Doesn't support async/await Is an odd choice.

romanovcode 7y ago

The HTTP library is super easy to use and is very fast. I would not say that this issue makes the library bad.

sebazzz 7y ago
Agreed. You could also use Curl bindings for .NET as an alternative.

victorNicollet 7y ago

Using cookies in HttpClient strikes me as a rare situation.