ChunkingCookieManager ChunkSize calculation fails to account for Uri Encoding
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
### Describe the bug
The ChunkingCookieManager attempts to break cookies up according to the default or configured ChunkSize. The calculation it performs against the length of the value is based on the raw value. However, the cookie value is encoded (via Uri.EscapeDataString) before being appended to response headers. Depending on the cookie value, that encoding step can significantly inflate the size of each chunk - easily surpassing what some browsers will accept.
I'm not clear on why we're aggressively encoding all cookies when that isn't required by the spec. But in any case, I believe ChunkingCookieManager has a bug. It should be considering the length of the encoded value since that is what browsers will see, not the passed in value.
### To Reproduce
Set a cookie using:
`new ChunkingCookieManager().AppendResponseCookie(HttpContext, "Test", "{\"Key\":\"Value\"}");`
Transmitted header is encoded:
`Set-Cookie: Test=%7B%22Key%22%3A%22Value%22%7D; path=/;`
ChunkingCookieManager believes it is dealing with a 15 character value. The actual cookie value is 29 characters.
Contributor guide
Assessment
This issue has not been assessed yet.