Aspnetcore.docs: Create a doc about using the cookie APIs in ASP.NET Core

[DamianEdwards]

ASP.NET Core includes a number of API areas for working with cookies. The APIs go beyond the simple "get and set cookies" for the request and response and include new APIs for controlling the various policy options around cookies (see Microsoft.AspNetCore.CookiePolicy).

The doc should also detail the default options and policy applied to the various cookies the framework itself issues. I'd likely place it in the "Fundamentals" section, with potential cross-reference from the "Security" section.

@Tratcher

[Rick-Anderson]

@DamianEdwards are you suggesting @Tratcher write the first draft. We don't have the expertise to author this.

Once we get a draft, we can publish within a week.

[Tratcher]

Want to do our usual interview?

[Rick-Anderson]

@scottaddie set up a skype with @Tratcher when you have time to work on this.

[Tratcher]

RE: https://github.com/aspnet/Home/issues/3432

[Rick-Anderson]

@serpent5 is this something you'd be interested in working on?

[serpent5]

Yeah, sure - I'm happy to take a look at this.

[serpent5]

I've been looking into the areas that might need describing for this. Here's a list of the cookies I've discovered that are set by the framework (default names listed):

• .AspNetCore.Antiforgery.XXX
• .AspNetCore.Consent
• .AspNetCore.Cookies
  
  
  
  • .AspNetCore.Identity.Application
  
  
  • .AspNetCore.Identity.External
  
  
  • .AspNetCore.Identity.TwoFactorRememberMe
  
  
  • .AspNetCore.Identity.TwoFactorUserId
  
  
• .AspNetCore.Mvc.CookieTempDataProvider

I've listed the Identity cookies underneath .AspNetCore.Cookies as these are all specialisations of the AddCookie stuff.

As for the API areas, I know of these pieces that might need describing:

• IResponseCookies
• CookieBuilder
• CookiePolicyOptions
• CookieAuthenticationOptions
• ConfigureApplicationCookie

Two initial questions:

1. What have I missed?
2. What have I included that shouldn't be?

Note that CookieBuilder, CookiePolicyOptions and CookieAuthenticationOptions have good coverage in Use cookie authentication without ASP.NET Core Identity. Perhaps CookieBuilder and CookiePolicyOptions could be pulled out and xrefed?

[Tratcher]

Additional cookies:

• Session
• Temp data

https://docs.microsoft.com/en-us/aspnet/core/fundamentals/app-state?view=aspnetcore-2.2

[serpent5]

Thanks @Tratcher. Sorry I haven't been back here sooner, but I've been trying to help with some other docs stuff in the meantime. I'm going to try and have a stab at this one next... Am I right in thinking that "Temp data" is .AspNetCore.Mvc.CookieTempDataProvider from those I listed above?

Does anyone subscribed to this issue have any input on the API areas I listed above?

[Tratcher]

Ah, yes, that's the temp data cookie.