dotnet / dotnet/aspnetcore

TempData could not be loaded if the cookie values were enclosed in double quotes

Open
#64,215 0 comments 0 reactions 0 assignees View on GitHub
area-dataprotection
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

### Waht is the problem
When using TempData, receiving a cookie value enclosed in double quotes causes a System.FormatException exception at WebEncoders.Base64UrlDecode().

According to [RFC6265](https://datatracker.ietf.org/doc/html/rfc6265) and [RFC6265bis](https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis-21#section-4.1.1-7), cookie values may be enclosed in double quotes.

> cookie-value = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )

> Per the grammar above, the cookie-value MAY be wrapped in DQUOTE characters. Note that in this case, the initial and trailing DQUOTE characters are not stripped. They are part of the cookie-value, and will be included in Cookie header fields sent to the server.

However, in the current ASP.NET Core, receiving a cookie value enclosed in double quotes causes the exception.

### Some clients enclose cookie values in double quotes
A small number of clients do enclose cookie values in double quotes. For example, [Python aiohttp](https://github.com/aio-libs/aiohttp) does this.

```
// Major browsers do not enclose in double quites
Cookie: .AspNetCore.Mvc.CookieTempDataProvider=

// But some clients do enclose in double quites
Cookie: .AspNetCore.Mvc.CookieTempDataProvider=""
```

I know these clients' behavior is technically in a gray area, but the point is that such implementations exist in reality.

### What should we do
The location where the exception occurs is [CookieTempDataProvider.LoadTempData](https://github.com/dotnet/aspnetcore/blob/23a53d6e2b6bcb98c9d8433c3cef93f9a2292e6c/src/Mvc/Mvc.ViewFeatures/src/CookieTempDataProvider.cs#L73). If we strip the double quotes at this point, it can be processed correctly.

https://github.com/dotnet/aspnetcore/blob/23a53d6e2b6bcb98c9d8433c3cef93f9a2292e6c/src/Mvc/Mvc.ViewFeatures/src/CookieTempDataProvider.cs#L70-L73

In addition, [CookieHeaderParserShared](https://github.com/dotnet/aspnetcore/blob/23a53d6e2b6bcb98c9d8433c3cef93f9a2292e6c/src/Http/Shared/CookieHeaderParserShared.cs#L229) recognizes double quotes but seems to return them without stripping them. We could strip the double quotes here, but i am concerned about the impact.

For reference, the [Go implementation](https://github.com/golang/go/blob/89dee70484669d546fff6ca29a4717368af351ff/src/net/http/cookie.go#L562) appears to automatically strip double quotes by default.

### Expected Behavior

TempData correctly recognizes values even when cookie values are enclosed in double quotes.

### Steps To Reproduce

1. Create an app and add controller actions
Create a standard ASP.NET Core MVC web application and add the following action to the HomeController.
```
public class HomeController : Controller
{
[HttpGet]
public ActionResult CookieTest()
{
TempData["foo"] = "Hello!";
return RedirectToAction("CookieTest2");
}

[HttpGet]
public ActionResult CookieTest2()
{
var rowVal = HttpContext.Request.Cookies[".AspNetCore.Mvc.CookieTempDataProvider"];
var fooVal = TempData["foo"];
return Content($"The foo value is {fooVal}.
The Base64 value is {rowVal}.", "text/html");
}
}
```

2. Run the app and acccess `https://localhost:/cookietest` by Major browser(Chrome)
The following result should be displayed. Make a note of the Base64 value.
```
The foo value is Hello!.
The Base64 value is .
```
3. Access cookietest2 with a cookie value enclosed in double quotes by curl
```
curl -b ".AspNetCore.Mvc.CookieTempDataProvider=\"\"" https://localhost:/cookietest2
```

The same applies to an empty string.
```
curl -b ".AspNetCore.Mvc.CookieTempDataProvider=\"\"" https://localhost:/cookietest2
```

### Exceptions (if any)

```
Microsoft.AspNetCore.Mvc.ViewFeatures.CookieTempDataProvider: Warning: The temp data cookie .AspNetCore.Mvc.CookieTempDataProvider could not be loaded.

System.FormatException: The input is not a valid Base-64 string as it contains a non-base 64 character, more than two padding characters, or an illegal character among the padding characters.
at System.Convert.FromBase64CharPtr(Char* inputPtr, Int32 inputLength)
at System.Convert.FromBase64CharArray(Char[] inArray, Int32 offset, Int32 length)
at Microsoft.AspNetCore.WebUtilities.WebEncoders.Base64UrlDecode(String input, Int32 offset, Int32 count)
at Microsoft.AspNetCore.Mvc.ViewFeatures.CookieTempDataProvider.LoadTempData(HttpContext context)
```

### .NET Version

_No response_

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Research direction

Start in src/Mvc/Mvc.ViewFeatures/src/CookieTempDataProvider.cs at LoadTempData, then inspect src/Http/Shared/CookieHeaderParserShared.cs where quoted cookie values are recognized. Reproduce the failure with the provided curl commands for quoted and empty values, and verify that TempData loads correctly without breaking unquoted cookie handling.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.