Repository navigation
Microsoft.AspNetCore.Server.Kestrel error: The chunked cookie is incomplete #830
Description
From @toddtsic on May 20, 2016 21:39
Really need a hand here, iOS is killing me...
Getting Kestrel error when iOS simulator (and presumably any iOS device), calls my asp.net web api app (RC2 app). Same error does NOT occur when accessed by android device.
Have successfully build cordova app in Visual Studio 2015, have submitted and have been approved at PlayStore, app working great.
Have been unsuccessful in getting AppStore approval.
Have been working in Windows 10 environment and using MacInCloud as my iOS app builder and tester. Everything working from point of view of Visual Studio building app on MacInCloud and successful in launching xcode simulator.
The app leverages heavily webapi2 calls (basically using Sql Server to get game score results). The api application successfully built and published to iis on my server using asp.net core RC2. I turned on logging on the server side so I can get details.
When simulating at MacInCloud, the iOS app fails after jwt user token validation with a "The chunked cookie is incomplete"
Specifically:
info: Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerMiddleware[3]
HttpContext.User merged via AutomaticAuthentication from authenticationScheme: Bearer.
fail: Microsoft.AspNetCore.Server.Kestrel, Version=1.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60[13]
Connection id "0HKS0QCDU42CH": An unhandled exception was thrown by the application.
System.FormatException: The chunked cookie is incomplete. Only 2 of the expected 3 chunks were found, totaling 7978 characters. A client size limit may have been exceeded.
at Microsoft.AspNetCore.Authentication.Cookies.ChunkingCookieManager.GetRequestCookie(HttpContext context, String key)
at Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler.<ReadCookieTicket>d__11.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler.<HandleAuthenticateAsync>d__12.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.AspNetCore.Authentication.AuthenticationHandler`1.<InitializeAsync>d__48.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware`1.<Invoke>d__18.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware`1.<Invoke>d__18.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware`1.<Invoke>d__18.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware`1.<Invoke>d__18.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware`1.<Invoke>d__18.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware`1.<Invoke>d__18.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware`1.<Invoke>d__18.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware`1.<Invoke>d__18.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware`1.<Invoke>d__18.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.ApplicationInsights.AspNetCore.ExceptionTrackingMiddleware.<Invoke>d__4.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.ApplicationInsights.AspNetCore.RequestTrackingMiddleware.<Invoke>d__4.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.AspNetCore.Server.IISIntegration.IISMiddleware.<Invoke>d__8.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.AspNetCore.Hosting.Internal.RequestServicesContainerMiddleware.<Invoke>d__3.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.AspNetCore.Server.Kestrel.Http.Frame`1.<RequestProcessingAsync>d__2.MoveNext()
info: Microsoft.AspNetCore.Hosting.Internal.WebHost[2]
Request finished in 10.467ms 200
I was getting this when my web api project was a RC1 project and thought that may be the issue. Have successfully ported project to RC2, but same error.
I'm using JWT bearer tokens for user authentication, so I don't get the cookie problem (not using cookies jwt token being passed in header...).
I do notice however that there are ionic cookies being written and wonder if that is related.
Any help/tips/leads would be greatly appreciated.
Todd
Copied from original issue: aspnet/KestrelHttpServer#858
Activity
Tratcher commentedon May 20, 2016
Have you tried clearing cookies on the client? Also, show the request headers so we can confirm the error is accurate.
Tratcher commentedon May 20, 2016
@toddtsic rather than capturing the headers on the client/emulator, can you attach the debugger to the server and view them there?
toddtsic commentedon May 20, 2016
That's a tricky proposition, I'm developing on Windows 10 box, using Visual
Studio and debugging on virtual mac server (MacInCloud). I published my
web api app to my company server (because can't get the virtual mac to see
my local box). My server is for production only, not running a development
environment.
Here's a curious addition:
I republished by cordova app to PlayStore (was working perfectly when web
api app was rc1 (remember I ported to rc2 thinking that had something to do
it).
The PlayStore publish was successful, now the android app is erroring on
contact with the web api server with (the following is coming from RC2's
logging capabilities, which awesome, I'd be lost without this ability...):
warn: Microsoft.Extensions.DependencyInjection.DataProtectionServices[59]
Neither user profile nor HKLM registry available. Using an ephemeral
key repository. Protected data will be unavailable when application exits.
warn:
Microsoft.AspNetCore.DataProtection.Repositories.EphemeralXmlRepository[50]
Using an in-memory repository. Keys will not be persisted to storage.
Hosting environment: Production
Content root path: D:\TSICV5\ProdApi
Now listening on: http://localhost:17676/
Application started. Press Ctrl+C to shut down.
info: Microsoft.AspNetCore.Hosting.Internal.WebHost[1]
Request starting HTTP/1.1 GET http://68.69.1.52/
info: Microsoft.AspNetCore.Hosting.Internal.WebHost[2]
Request finished in 750.1119ms 404
This is fascinating, "listening on localhost", wow... I'm pretty sure I'm
not understanding something about the huge changes in RC2, but I'll see the
process through and try to understand, not one to turn back...
T
On Fri, May 20, 2016 at 2:54 PM, Chris R notifications@github.com wrote:
Todd Greenwald
President, TeamSportsInfo.com
tgreenwald@teamsportsinfo.com
410-703-3450
toddtsic commentedon May 20, 2016
A little research on this leads me to believe:
My problem is the combination of using jwt token authentication, AND
app.UseIdentity (which uses cookie).
I'm looking into whether its possible to use identity (UserManager magic is
very helpful), WITHOUT cookies.
T
On Fri, May 20, 2016 at 3:02 PM, Todd Greenwald <
tgreenwald@teamsportsinfo.com> wrote:
Todd Greenwald
President, TeamSportsInfo.com
tgreenwald@teamsportsinfo.com
410-703-3450
npnelson commentedon May 21, 2016
I had the same error under different circumstances.
#614 (comment)
It took me days to figure out what was going on, but the bottom line is mobile browsers like Safari can only store roughly 8200 bytes worth of cookies per domain. I think the chunked cookie manager chunks 4090 bytes per cookie (which is another safari mobile limitation only 4093 bytes per cookie) so if it requires more than 2 chunks, Safari is going to toss the rest of the cookies.
I was able to cut down the number of claims associated with the identity to get under the cookie size limit, but if you don't have that luxury, then I think you are left with storing a session key in the cookie and then getting the rest from a cache or distributed cache, something like:
#824
toddtsic commentedon May 21, 2016
Nicholas,
Thank you so much for your response, what you write tracks totally with my
experience. I was using claims to store data, and experienced symptoms
proportionally with size of claims stored. I'll refactor accordingly.
Todd
On Fri, May 20, 2016 at 7:41 PM, Nicholas P Nelson <notifications@github.com
Todd Greenwald
President, TeamSportsInfo.com
tgreenwald@teamsportsinfo.com
410-703-3450
npnelson commentedon May 22, 2016
This is a nasty error when you get it. I think more and more people will run into this. The limitation has always been there, but I have a couple of ideas as to why I didn't run into it in my MVC 5 apps.
First, I wasn't using openIDConnect in my MVC 5 app and thus wasn't pulling down the full range of claims available like the openIDConnect middleware does since its default scope is set to "profile".
Second, with all the examples out there, I started adding a lot of my own claims. I thought, this looks easy and convenient, why don't I just put this stuff in the claims instead of looking it up with each request?
The error message says it all: "A client size limit may have been exceeded", but to the average line of business application developer learning ASPNetCore, the remedy isn't obvious.
Unfortunately, I don't have any good ideas to improve the experience. Here are a few, but I can't say I'm happy any of them.
Put a few warnings in docs.asp.net to warn developers against adding too many of their own claims due to mobile browser cookie store limitations.
Maybe log a warning through ILogger when it is sending more than 8,200 (roughly) bytes in the identity cookie something like "The size of your identity cookie exceeds the capacity of many mobile browsers. Requests originating from mobile browsers will likely fail. Consider reducing the number of claims in your identity cookie or store your identity in a distributed cache". I think this is probably easier said than done and probably doesn't cover all the use cases.
toddtsic commentedon May 22, 2016
Thanks for everyone's assistance. The issue was that I was stuffing too much data into claims in my web api program. I restricted the use of claims to my jwt token only, and move other data out. With that all environments are working fine.
hasanoruc commentedon Aug 17, 2016
i get the same issue and i solved my problem with doing this.
i checked my web api method and i forgot [FromBody] tag in front of my json objects.
So my method parameters like this:
[FromBody]JObject obj