CredentialCache does not handle encoded slashes (%2f) correctly
Open
area-System.Net
- Dominant language
- C#
- Stars
- 18.3k
- Forks
- 5.6k
- PR merge metrics
- PR metrics pending
Description
When comparing prefixes for potential match, CredentialCache does not take into acount that some characters may be %-encoded, for example.
http://host/a/b/c
and
http://host/a%2fb/c
are equivalent, but will the second will not reuse the credential for `a/b` path on the host.
Contributor guide
Research direction
Start by locating CredentialCache and read the prefix-comparison logic described in the issue. Reproduce the examples with /a/b/c and /a%2fb/c, then verify that the encoded-slash form reuses the credential for the a/b path without changing unrelated prefix matches.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100