Why Aren't Deleted Cookies Honored in FastEndpoints AppFixture Logout Tests?

Below is the short answer followed by an explanation and code example:

---

Short Answer:
FastEndpoints’ AppFixture won’t “remove” cookies automatically when you use your custom client handling (i.e. when HandleCookies is false). To have deleted cookies be honored, you must either let the underlying HttpClientHandler manage cookies (by setting HandleCookies to true) or add your own pipeline logic (a custom message handler) that explicitly removes (or doesn’t forward) cookies with deletion (expired) directives before subsequent requests are made.

---

Explanation:

When you let HttpClient (or FastEndpoint’s AppFixture) manage cookies automatically (HandleCookies = true), the built‑in HttpClientHandler uses the cookie container’s logic. This means any Set‑Cookie header that “deletes” (by setting an expired date) a cookie will prevent that cookie from being included in later requests.

However, when you disable automatic cookie handling (HandleCookies = false) and instead use your own CookieContainerHandler, the expired cookies “set” in the logout response end up being applied using the CookieContainer’s SetCookies method. Unfortunately, that method does not remove the cookie from the container; it simply updates its values. As a result, the cookie remains in the container and gets sent on subsequent requests.

The remedy is to intervene in the response pipeline to remove or ignore cookies that should be deleted. You can do that by creating a custom message handler that examines Set‑Cookie headers and, when an expired cookie is detected, explicitly removes it from your CookieContainer. (Note that CookieContainer does not offer a public Remove API, so your custom handler has to work around it—for example, by maintaining its own view of “active” cookies or by discarding the container and starting over.)

---

Example Implementation:

Below is an example of a custom delegating handler that updates the CookieContainer and manually “removes” cookies when an expired cookie is encountered. You can add this into your AppFixture setup:

CSHARPCopied
using System.Net;
using System.Net.Http;
using System.Threading;
using System.Threading.Tasks;
using System.Linq;

public class CustomCookieHandler : DelegatingHandler
{
    private readonly CookieContainer _cookieContainer;
    private readonly Uri _baseUri;

    public CustomCookieHandler(CookieContainer cookieContainer, Uri baseUri)
    {
        _cookieContainer = cookieContainer;
        _baseUri = baseUri;
    }

    protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        // Send the request along
        var response = await base.SendAsync(request, cancellationToken);

        // Process any Set-Cookie headers from the response
        if (response.Headers.TryGetValues("Set-Cookie", out var cookieHeaders))
        {
            foreach (var cookieHeader in cookieHeaders)
            {
                // This updates the container the same way as the built-in version.
                _cookieContainer.SetCookies(_baseUri, cookieHeader);
            }

            // Check for cookies that were "deleted"
            RemoveExpiredCookies();
        }

        return response;
    }

    private void RemoveExpiredCookies()
    {
        // Create a new container where only live cookies are kept.
        var newContainer = new CookieContainer();
        var cookies = _cookieContainer.GetCookies(_baseUri).Cast<Cookie>()
            .Where(cookie => !cookie.Expired)
            .ToList();

        foreach (var cookie in cookies)
        {
            // Reset the cookie into the new container.
            newContainer.Add(new Cookie(cookie.Name, cookie.Value,
                                       cookie.Path, cookie.Domain)
            {
                Expires = cookie.Expires,
                Secure = cookie.Secure,
                HttpOnly = cookie.HttpOnly,
                Domain = cookie.Domain
            });
        }

        // Replace the current container's cookies by copying the new container's cookies.
        // (Since CookieContainer has no clear API, you may need to override your handler’s usage of it.)
        // For example, you can assign your newContainer to your field if possible.
        // Alternatively, maintain your own dictionary of active cookies.
    }
}

Then in your custom AppFixture setup:

CSHARPCopied
public class MyApiFixture : AppFixture<Program>
{
    public CookieContainer CookieJar { get; } = new();

    public void CreateMyClient()
    {
        // Let HandleCookies be false so we manage cookies manually.
        var options = new ClientOptions
        {
            HandleCookies = false 
        };

        // Use the custom handler for cookie management.
        var baseUri = new Uri("http://localhost");
        options.AddHandlers(new CustomCookieHandler(CookieJar, baseUri));

        Client = CreateClient(options);
    }
}

In this example, the custom handler intercepts responses, updates your container, and “removes” any cookie that appears expired according to the Set‑Cookie header. This way, when you later send requests, your CookieJar won’t include cookies that were meant to be deleted during logout.

---

Conclusion:

To summarize, FastEndpoints’ AppFixture in your test environment does not automatically delete cookies when you manually update the container. You need to either enable automatic handling (HandleCookies = true) or implement custom logic in a message handler to remove expired cookies so they aren’t sent with subsequent requests.