Microsoft.Owin, v. 4.2.3, System.Web.HttpException (0x80004005)

[aimi617]

After upgrading to Microsoft.Owin, v. 4.2.3, we have massive System.Web.HttpException (0x80004005) errors: "Server cannot append cookies after HTTP headers have been sent". There is no such problem with a previous version and we had to downgrade back to v. 4.2.2 to make an application usable. Application: ASP.Net MVC website based on .Net Framework 4.8.1 running on IIS 10 of Windows Server 2022. Below is the exception details:

System.Web.HttpException (0x80004005): Server cannot append cookies after HTTP headers have been sent.
at System.Web.HttpResponse.AppendCookie(HttpCookie cookie)
at Microsoft.Owin.Host.SystemWeb.SystemWebChunkingCookieManager.AppendResponseCookie(IOwinContext context, String key, String value, CookieOptions options) in //src/Microsoft.Owin.Host.SystemWeb/SystemWebChunkingCookieManager.cs:line 241
at Microsoft.Owin.Security.Cookies.CookieAuthenticationHandler.d__13.MoveNext() in //src/Microsoft.Owin.Security.Cookies/CookieAuthenticationHandler.cs:line 310
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Owin.Security.Infrastructure.AuthenticationHandler.d__40.MoveNext() in //src/Microsoft.Owin.Security/Infrastructure/AuthenticationHandler.cs:line 179
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Owin.Security.Infrastructure.AuthenticationHandler.d__39.MoveNext() in //src/Microsoft.Owin.Security/Infrastructure/AuthenticationHandler.cs:line 167
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Owin.Security.Infrastructure.AuthenticationHandler.d__34.MoveNext() in //src/Microsoft.Owin.Security/Infrastructure/AuthenticationHandler.cs:line 96
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Owin.Security.Infrastructure.AuthenticationMiddleware1.<Invoke>d__5.MoveNext() in /_/src/Microsoft.Owin.Security/Infrastructure/AuthenticationMiddleware.cs:line 32 --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.AspNet.Identity.Owin.IdentityFactoryMiddleware2.d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.AspNet.Identity.Owin.IdentityFactoryMiddleware2.<Invoke>d__5.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at Microsoft.AspNet.Identity.Owin.IdentityFactoryMiddleware2.d__5.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Owin.Mapping.MapMiddleware.d__3.MoveNext() in //src/Microsoft.Owin/Mapping/MapMiddleware.cs:line 72
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Owin.Security.Infrastructure.AuthenticationMiddleware`1.d__5.MoveNext() in //src/Microsoft.Owin.Security/Infrastructure/AuthenticationMiddleware.cs:line 30
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.IntegratedPipelineContextStage.d__7.MoveNext() in //src/Microsoft.Owin.Host.SystemWeb/IntegratedPipeline/IntegratedPipelineContextStage.cs:line 85
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.IntegratedPipelineContext.d__12.MoveNext() in //src/Microsoft.Owin.Host.SystemWeb/IntegratedPipeline/IntegratedPipelineContext.cs:line 153
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.StageAsyncResult.End(IAsyncResult ar) in //src/Microsoft.Owin.Host.SystemWeb/IntegratedPipeline/StageAsyncResult.cs:line 76
at System.Web.HttpApplication.AsyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

[kevinchalet]

Katana 4.2.3 now uses the cookie managers provided by the SystemWeb host, that may have stricter "has response started?" validation rules than the non-HttpResponse-aware managers used in previous versions.

Try replacing the default managers using the new IAppBuilder SetDefault*CookieManager() extensions to see if it changes anything:

app.SetDefaultCookieManager(new CookieManager());
app.SetDefaultChunkingCookieManager(new ChunkingCookieManager());

[aimi617]

Looks like problem is resolved, the culprit was a line with System.Web.HttpContext.Current.Response.ClearHeaders();, after removing, no errors yet.

[aimi617]

Unfortunately the error came back with same exception "Server cannot append cookies after HTTP headers have been sent". It appears randomly and cannot be simulated on localhost and happens on production server only.