title: ASP.NET Cookies BUG - multiple cookies duplicated randomly?
body: <p>It seems that there is annoying bug in ASP.NET cookie handling during writing of response-stream to the wire. <code>Set-Cookie</code> headers are multiplied randomly.</p>
  
  <p>My example setup is: <em>ASP.NET MVC4</em> on <em>IIS8 express</em> server, but same issue happens on <em>IIS7 integrated mode</em>, and I found posts about the same issue <em>IIS6</em> back in 2009. It seem to be issue exists for a while.</p>
  
  <p>For example, in Global.asax.cs I subscribe to BeginRequest event and write to HttpResponse.Cookie collection in my event handler:</p>
  
  <pre><code>public class MvcApplication : System.Web.HttpApplication
  {
      public override void Init()
      {
          base.Init();
          BeginRequest += OnBeginRequest;
      }
  
      void OnBeginRequest(object sender, EventArgs e)
      {
          Response.Cookies.Set(new HttpCookie("OnBeginRequest", "0"));
      }
  }
  </code></pre>
  
  <p>This will, already, output "OnBeginRequest" Set-Cookie header twice. But, if similar is done for all HttpApplication events (AuthenticateRequest, AcquireRequestState, etc... total ~20 events), header of http response sent to browser will have LOT of duplicates written. It's also obvious after which event writing of cookies start from begging.</p>
  
  <pre><code>HTTP/1.1 200 OK
  Cache-Control: private
  Content-Type: text/html; charset=utf-8
  Server: Microsoft-IIS/7.5
  Set-Cookie: OnBeginRequest=0; path=/
  Set-Cookie: OnBeginRequest=0; path=/
  Set-Cookie: OnAuthenticateRequest=1; path=/
  Set-Cookie: OnBeginRequest=0; path=/
  Set-Cookie: OnAuthenticateRequest=1; path=/
  Set-Cookie: OnPostAuthenticateRequest=2; path=/
  Set-Cookie: OnBeginRequest=0; path=/
  Set-Cookie: OnAuthenticateRequest=1; path=/
  Set-Cookie: OnPostAuthenticateRequest=2; path=/
  Set-Cookie: OnAuthorizeRequest=3; path=/
  Set-Cookie: OnPostAuthorizeRequest=4; path=/
  Set-Cookie: OnBeginRequest=0; path=/
  Set-Cookie: OnAuthenticateRequest=1; path=/
  Set-Cookie: OnPostAuthenticateRequest=2; path=/
  Set-Cookie: OnAuthorizeRequest=3; path=/
  Set-Cookie: OnPostAuthorizeRequest=4; path=/
  Set-Cookie: OnResolveRequestCache=5; path=/
  Set-Cookie: OnPostResolveRequestCache=6; path=/
  Set-Cookie: OnBeginRequest=0; path=/
  Set-Cookie: OnAuthenticateRequest=1; path=/
  Set-Cookie: OnPostAuthenticateRequest=2; path=/
  Set-Cookie: OnAuthorizeRequest=3; path=/
  Set-Cookie: OnPostAuthorizeRequest=4; path=/
  Set-Cookie: OnResolveRequestCache=5; path=/
  Set-Cookie: OnPostResolveRequestCache=6; path=/
  Set-Cookie: OnMapRequestHandler=7; path=/
  Set-Cookie: OnBeginRequest=0; path=/
  Set-Cookie: OnAuthenticateRequest=1; path=/
  Set-Cookie: OnPostAuthenticateRequest=2; path=/
  Set-Cookie: OnAuthorizeRequest=3; path=/
  Set-Cookie: OnPostAuthorizeRequest=4; path=/
  Set-Cookie: OnResolveRequestCache=5; path=/
  Set-Cookie: OnPostResolveRequestCache=6; path=/
  Set-Cookie: OnMapRequestHandler=7; path=/
  Set-Cookie: OnPostMapRequestHandler=8; path=/
  Set-Cookie: OnAcquireRequestState=9; path=/
  Set-Cookie: OnPostAcquireRequestState=10; path=/
  Set-Cookie: OnPreRequestHandlerExecute=11; path=/
  X-AspNetMvc-Version: 4.0
  X-AspNet-Version: 4.0.30319
  Set-Cookie: OnBeginRequest=0; path=/
  Set-Cookie: OnAuthenticateRequest=1; path=/
  Set-Cookie: OnPostAuthenticateRequest=2; path=/
  Set-Cookie: OnAuthorizeRequest=3; path=/
  Set-Cookie: OnPostAuthorizeRequest=4; path=/
  Set-Cookie: OnResolveRequestCache=5; path=/
  Set-Cookie: OnPostResolveRequestCache=6; path=/
  Set-Cookie: OnMapRequestHandler=7; path=/
  Set-Cookie: OnPostMapRequestHandler=8; path=/
  Set-Cookie: OnAcquireRequestState=9; path=/
  Set-Cookie: OnPostAcquireRequestState=10; path=/
  Set-Cookie: OnPreRequestHandlerExecute=11; path=/
  Set-Cookie: OnPostRequestHandlerExecute=12; path=/
  Set-Cookie: OnReleaseRequestState=13; path=/
  Set-Cookie: OnPostReleaseRequestState=14; path=/
  Set-Cookie: OnBeginRequest=0; path=/
  Set-Cookie: OnAuthenticateRequest=1; path=/
  Set-Cookie: OnPostAuthenticateRequest=2; path=/
  Set-Cookie: OnAuthorizeRequest=3; path=/
  Set-Cookie: OnPostAuthorizeRequest=4; path=/
  Set-Cookie: OnResolveRequestCache=5; path=/
  Set-Cookie: OnPostResolveRequestCache=6; path=/
  Set-Cookie: OnMapRequestHandler=7; path=/
  Set-Cookie: OnPostMapRequestHandler=8; path=/
  Set-Cookie: OnAcquireRequestState=9; path=/
  Set-Cookie: OnPostAcquireRequestState=10; path=/
  Set-Cookie: OnPreRequestHandlerExecute=11; path=/
  Set-Cookie: OnPostRequestHandlerExecute=12; path=/
  Set-Cookie: OnReleaseRequestState=13; path=/
  Set-Cookie: OnPostReleaseRequestState=14; path=/
  Set-Cookie: OnUpdateRequestCache=15; path=/
  Set-Cookie: OnPostUpdateRequestCache=16; path=/
  Set-Cookie: OnLogRequest=17; path=/
  Set-Cookie: OnPostLogRequest=18; path=/
  Set-Cookie: OnEndRequest=19; path=/
  Set-Cookie: OnBeginRequest=0; path=/
  Set-Cookie: OnAuthenticateRequest=1; path=/
  Set-Cookie: OnPostAuthenticateRequest=2; path=/
  Set-Cookie: OnAuthorizeRequest=3; path=/
  Set-Cookie: OnPostAuthorizeRequest=4; path=/
  Set-Cookie: OnResolveRequestCache=5; path=/
  Set-Cookie: OnPostResolveRequestCache=6; path=/
  Set-Cookie: OnMapRequestHandler=7; path=/
  Set-Cookie: OnPostMapRequestHandler=8; path=/
  Set-Cookie: OnAcquireRequestState=9; path=/
  Set-Cookie: OnPostAcquireRequestState=10; path=/
  Set-Cookie: OnPreRequestHandlerExecute=11; path=/
  Set-Cookie: OnPostRequestHandlerExecute=12; path=/
  Set-Cookie: OnReleaseRequestState=13; path=/
  Set-Cookie: OnPostReleaseRequestState=14; path=/
  Set-Cookie: OnUpdateRequestCache=15; path=/
  Set-Cookie: OnPostUpdateRequestCache=16; path=/
  Set-Cookie: OnLogRequest=17; path=/
  Set-Cookie: OnPostLogRequest=18; path=/
  Set-Cookie: OnEndRequest=19; path=/
  Set-Cookie: OnPreSendRequestContent=20; path=/
  Set-Cookie: OnPreSendRequestHeaders=21; path=/
  X-Powered-By: ASP.NET
  Date: Mon, 20 May 2013 10:47:20 GMT
  Content-Length: 4002
  </code></pre>
  
  <p>Even worse, if same cookie is written in 1 event handler, then updated in another, duplicates with different values will appear in the header.</p>
  
  <p>Are there any settings or workaround that can prevent this behavior of default <code>HttpResponse.Cookies</code> collection?</p>