title: ASP .NET Core webapi set cookie in middleware
body: <p>I'm trying to set a cookie after the action is executed, struggling to get this working. I managed to see the cookie if I set it from a controller, but not from a middleware.
  I have played with the order of the configuration and nothing.
  The code sample is from a clean webapi created project, so if someone wants to play with it is simple, just create an empty webapi, add the CookieSet class and replace the Startup class with the one below (only added are the cookie policy options)</p>
  <p>Here is my middleware</p>
  <pre><code>public class CookieSet
  {
      private readonly RequestDelegate _next;
  
      public CookieSet(RequestDelegate next)
      {
          _next = next;
      }
  
      public async Task Invoke(HttpContext context)
      {
          await _next.Invoke(context);
          var cookieOptions = new CookieOptions()
          {
              Path = &quot;/&quot;,
              Expires = DateTimeOffset.UtcNow.AddHours(1),
              IsEssential = true,
              HttpOnly = false,
              Secure = false,
          };
          context.Response.Cookies.Append(&quot;test&quot;, &quot;cookie&quot;, cookieOptions);
      }
  }
  </code></pre>
  <p>I have added the p assignment and checked that the execution never gets there, on the Cookies.Append line it stops the execution, so there is something going on I can't figure it out.</p>
  <p>And here is my Startup class</p>
  <pre><code>public class Startup
  {
      public Startup(IConfiguration configuration)
      {
          Configuration = configuration;
      }
  
      public IConfiguration Configuration { get; }
  
      // This method gets called by the runtime. Use this method to add services to the container.
      public void ConfigureServices(IServiceCollection services)
      {
          services.Configure&lt;CookiePolicyOptions&gt;(options =&gt;
          {
              options.CheckConsentNeeded = context =&gt; false;
              options.MinimumSameSitePolicy = SameSiteMode.None;
              options.HttpOnly = HttpOnlyPolicy.None;
              options.Secure = CookieSecurePolicy.None;
              // you can add more options here and they will be applied to all cookies (middleware and manually created cookies)
          });
  
          services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
      }
  
      // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
      public void Configure(IApplicationBuilder app, IHostingEnvironment env)
      {
          app.UseCookiePolicy(new CookiePolicyOptions
          {
              CheckConsentNeeded = c =&gt; false,
              HttpOnly = HttpOnlyPolicy.None,
              Secure = CookieSecurePolicy.None,
              MinimumSameSitePolicy = SameSiteMode.None,
          });
  
          app.UseMiddleware&lt;CookieSet&gt;();
  
          if (env.IsDevelopment())
          {
              app.UseDeveloperExceptionPage();
          }
  
          app.UseMvc();
      }
  }
  </code></pre>
  <p>I have set all the options to the minimum requirements, tested with chrome and fiddler and nothing.</p>