Kameleoon C# SDK duplicated the visitor-code cookie until proxies rejected responses

Kameleoon C# SDK duplicated the visitor-code cookie until proxies rejected responses

TL;DR

Fixed in 4.22.1: the SDK now removes any previously added kameleoonVisitorCode Set-Cookie header before writing the new value, so the response carries a single header with the latest visitor code. If you see sporadic HTTP 520s from Cloudflare in front of a .NET app using Kameleoon, check your SDK version first - duplicate Set-Cookie accumulation was the cause. Upgrade to 4.22.1+; on older versions, avoid calling SetLegalConsent/GetVisitorCode repeatedly per request as a workaround.

Use this when you run into the situation in the title.

When not to use this skill: unrelated tasks. It covers only the procedure above.

Compatibility

The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

Details

Context: Official Kameleoon changelog (kameleoon-new/client-csharp, 4.22.1): calling SetLegalConsent or GetVisitorCode multiple times within a single request appended a duplicate kameleoonVisitorCode Set-Cookie header on each call. The changelog notes the real-world consequence: the header bloating could inflate responses enough to be rejected by intermediary proxies - Cloudflare responding with HTTP 520 errors.

Source: Official Kameleoon changelog (kameleoon-new/client-csharp, 4.22.1): calling SetLegalConsent or GetVisitorCode multiple times within a single request appended a duplicate kameleoonVisitorCode Set-Cookie header on each call. The changelog notes the real-world consequence: the header bloating could inflate responses enough to be rejected by intermediary proxies - Cloudflare responding with HTTP 520 errors.

Verified resolution: Fixed in 4.22.1: the SDK now removes any previously added kameleoonVisitorCode Set-Cookie header before writing the new value, so the response carries a single header with the latest visitor code. If you see sporadic HTTP 520s from Cloudflare in front of a .NET app using Kameleoon, check your SDK version first - duplicate Set-Cookie accumulation was the cause. Upgrade to 4.22.1+; on older versions, avoid calling SetLegalConsent/GetVisitorCode repeatedly per request as a workaround.

Source URL: https://github.com/kameleoon-new/client-csharp/blob/HEAD/CHANGELOG.md#4221---2026-07-15