dotnet / dotnet/runtime

CredentialCache does not handle encoded slashes (%2f) correctly

Open
#131,194 1 comment 0 reactions 0 assignees View on GitHub
area-System.Net
Dominant language
C#
Stars
18.3k
Forks
5.6k
PR merge metrics
PR metrics pending

Description

When comparing prefixes for potential match, CredentialCache does not take into acount that some characters may be %-encoded, for example.

http://host/a/b/c

and

http://host/a%2fb/c

are equivalent, but will the second will not reuse the credential for `a/b` path on the host.

Contributor guide

Open the contributing guide

Research direction

Start by locating CredentialCache and read the prefix-comparison logic described in the issue. Reproduce the examples with /a/b/c and /a%2fb/c, then verify that the encoded-slash form reuses the credential for the a/b path without changing unrelated prefix matches.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.