title: Binding action parameters to request cookies in ASP.NET MVC - what happened?
body: <p>In several early previews of ASP.NET MVC, arguments to controller methods would be resolved by inspecting the query string, then the form, then the cookies and server variables collections, as documented in <a href="http://stephenwalther.com/blog/archive/2008/07/08/asp-net-mvc-tip-15-pass-browser-cookies-and-server-variables-as-action-parameters.aspx" rel="nofollow noreferrer">this post from Stephen Walther</a>.</p>
  
  <p>For example, this code used to work:</p>
  
  <pre><code>public class MyController : Controller {
  
      // This should bind to Request.Cookies["userId"].Value
      public ActionResult Welcome(int userId) {
  
          WebUser wu = WebUser.Load(userId);
          ViewData["greeting"] = "Welcome, " + wu.Name;
          return(View());
      }
  }
  </code></pre>
  
  <p>but now running against the release candidate, it throws an exception because it can't find a value for userId, even though userId definitely appears in the request cookies.</p>
  
  <p>Was this change covered anywhere in the release notes? If this is a change to the framework, is there now a recommended alternative to binding cookies and server variables in this way?</p>
  
  <p>EDIT: Thanks to those of you who have responded so far. I may have picked a bad example to demonstrate this; our code uses cookies for various forms of "convenient" but non-essential persistence (remembering ordering of search results, that kind of thing), so it's by no means purely an authentication issue. The security implications of relying on user cookies are well documented; I'm more interested in current recommendations for flexible, easily testable techniques for retrieving cookie values. (As I'm sure you can appreciate, the above example may have security implications, but is very, very easy to test!)</p>