Pass header cookies from Web API post to header location page

Question

I have an ASP.Net Web API that is posted to from an external source. The values that are posted to the web api are used to determine the user's rights on our website. So the web api then passes the result object of my business logic as a bunch of cookies to our asp landing page. The problem is that the cookies are no longer available in the web page that the web api routed the response to.

Here is web api:

 [HttpPost]
 public HttpResponseMessage Reports(ReportRequest reportRequest)
 {
 if (reportRequest != null)
 {
 var reportAccess = new SwitchBL().CheckUserAccess(reportRequest);
 var response = Request.CreateResponse(HttpStatusCode.Moved);
 response.Headers.Location = new Uri(BaseUrl() + "/menu.aspx");
 var json = JsonConvert.SerializeObject(reportAccess);
 Dictionary<string, string> biscuitTin = JsonConvert.DeserializeObject<Dictionary<string, string>>(json);
 foreach (var biscuit in biscuitTin)
 {
 var cookie =
 new CookieHeaderValue(biscuit.Key, biscuit.Value ?? "")
 {
 Expires = DateTimeOffset.Now.AddDays(1),
 Domain = Request.RequestUri.Host == "localhost" ? null : Request.RequestUri.Host,
 HttpOnly = true
 };
 //cookierJar.Add(cookie);
 response.Headers.AddCookies(new CookieHeaderValue[] {cookie} );
 }
 return response;
 }
 return Request.CreateResponse(HttpStatusCode.BadRequest);
 }

And so far my very simple aspx page always shows count = 0:

public partial class menu : System.Web.UI.Page
{
 protected void Page_Load(object sender, EventArgs e)
 {
 var cookieCount = Request.Cookies.Count;
 }
}

The web api and aspx pages are in the same project thus hosted in one site. I do not want to use session variables and do not want to pass values in querystrings. Is there another way of passing data to the routed page from the web api or am I missing something here?

BTW, if I post to the api using Postman, the cookies are visible in the response header of the web api, so cookies are created. If I post using another web page, using Fiddler, I can see the cookies in the response of the api but then there are no cookies in the (receiving) asp page.

UPDATE Thanks to the answer of Kai, I can now get the cookies in my route asp page as set in response.Headers.Location. I have a breakpoint in that page so I know it is being hit and cookie count is now as expected. However, the browser does not render the routed page. It remains on the original posting page. Here is the code I'm using in my post emulator page to call the web api:

protected void Page_Load(object sender, EventArgs e)
{
}
protected async void DoIt_OnClick(object sender, EventArgs e)
{
 var reportRequest = new ReportRequest();
 reportRequest.EmailAddress = Email.Text;
 reportRequest.UserNumber = UserCode.Text;
 reportRequest.MobileNumber = MobileNumber.Text;
 reportRequest.Password = Password.Text;
 reportRequest.Country = Country.Text;
 reportRequest.AccountNumber = AccountNumber.Text;
 reportRequest.AccountType = AccountType.Text;
 reportRequest.ReportType = ReportType.Text == "" ? 0 : Convert.ToInt32(ReportType.Text);
 reportRequest.PhoneInfo = PhoneInfo.Text;
 await GoThereAsync(reportRequest);
}
public async Task<Uri> GoThereAsync(ReportRequest reportRequest)
{
 using (var client = new HttpClient())
 {
 client.BaseAddress = new Uri("http://localhost:7789/");
 client.DefaultRequestHeaders.Accept.Clear();
 client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("text/plain"));
 var response = await client.PostAsJsonAsync<ReportRequest>("api/switch/reports", reportRequest);
 if (response.IsSuccessStatusCode)
 {
 return response.RequestMessage.RequestUri;
 }
 return null;
 }
}

To summarise: Emulator.aspx does POST to web api. Web API sets cookies and location to home.aspx. Home.aspx receives cookies (debug steps into code-behind) but browser remains on Emulat.aspx and does not render home.aspx.

Answer 1

Try CookieHeaderValue.Path = "/".

From the Microsoft Docs:

Path: Restricts the cookie to the specified path within the domain. If not specified, the path of the request URI is used.

• Neville: I had the path and in all my fiddling removed it. Putting it back as suggested fixed the cookie problem. Please see update for second part of my question please.
• Kai: redirect: response.Headers.Location = new Uri("http://localhost:7789/");
• Neville: Already have that in the post action: response.Headers.Location = new Uri(BaseUrl() + "/menu.aspx")