High Volume of "Server cannot append header after HTTP headers have been sent" exceptions on authenticated frontend requests

Authenticated frontend requests throw high-volume "Server cannot append header" exceptions when the CDN roles cookie feature is enabled.

Oct 15, 2026
Knowledge

Title

URL Name

high-volume-of-server-cannot-append-header-after-http-headers-have-been-sent-exceptions-on-authenticated-frontend-requests

Article Number

000306552

Environment

Product: Sitefinity Version: 15.4.8637, 15.4.8638, 15.4.8639 OS: All supported OS versions Database: All supported Microsoft SQL Server versions

Question/Problem Description

When the CDN roles cookie feature is enabled (EnableCdnRolesCookie = true), authenticated frontend requests generate a high volume of the exception "Server cannot append header after HTTP headers have been sent" in CdnRolesCookieWriter.SetRolesCookie. The exception may cause downstream authentication failures, including 502 Bad Gateway responses on /api/default/users/current and user context resolution failures on the .NET Core Renderer. Backend users are not affected.

Steps to Reproduce

1. Enable the CDN roles cookie. 2. Log in as a frontend user (non-administrator) with at least one role assigned. 3. Wait for the CDN roles cookie TTL to expire (configured via CdnRolesCookieTtlMinutes) while the authentication session remains active. 4. Send concurrent authenticated requests to the site (e.g., navigate to a page or refresh under moderate traffic). 5. The exception is logged when the proactive CDN roles cookie refresh fires after response headers have already been flushed.

Clarifying Information

The issue does not affect backend users (Administrators, Editors) due to the IsBackendUser exclusion in SetRolesCookie().
Higher-traffic environments and shorter CdnRolesCookieTtlMinutes values increase exception frequency.
If a CDN (Cloudflare, Akamai, etc.) is in front of the site, the resulting error response may be cached at the CDN edge, amplifying the impact.

Error Message

System.Web.HttpException (0x80004005): Server cannot append header after HTTP headers have been sent. at System.Web.HttpHeaderCollection.SetHeader(String name, String value, Boolean replace) at Microsoft.Owin.Host.SystemWeb.CallHeaders.AspNetResponseHeaders.Set(String key, String[] values) at Microsoft.Owin.Infrastructure.ChunkingCookieManager.AppendResponseCookie(IOwinContext context, String key, String value, CookieOptions options) at Telerik.Sitefinity.Authentication.Cookies.CdnRolesCookieWriter.SetRolesCookie(IOwinContext context, SitefinityCookieAuthenticationOptions options, ClaimsIdentity identity, Boolean isPersistent, Nullable`1 expiresUtc) at Telerik.Sitefinity.Authentication.Cookies.SitefinityCookieAuthenticationHandler.RefreshCdnRolesCookie(AuthenticationTicket ticket) at Telerik.Sitefinity.Authentication.Cookies.SitefinityCookieAuthenticationHandler.<ApplyResponseGrantAsync>d__2.MoveNext()

Defect Number

604749

Enhancement Number

Cause

The issue is caused by a bug in Sitefinity

Resolution

Fixed in:

Sitefinity Patch 15.4.8640

Refer to Knowledge Base Article How to update Sitefinity to hotfix, internal build or a patch for instructions on how to download and install the fix.

Workaround

If the CDN roles cookie feature is not required, disable it to prevent the exception.

Note: Disabling this feature means the CDN will no longer receive role-based cookie information for output-cache variations per user role. This may affect CDN caching behavior for authenticated users.

Notes

Progress Article(s):

Authentication: "Server cannot append header after HTTP headers have been sent" in SitefinityCookieAuthenticationHandler

Keyword Phrase

Last Modified Date

10/28/2026 2:58 PM

High Volume of "Server cannot append header after HTTP headers have been sent" exceptions on authenticated frontend requests

Files(0)

Was this article helpful?

Was this article helpful?

High Volume of "Server cannot append header after HTTP headers have been sent" exceptions on authenticated frontend requests

Information

Related Articles