Comma's in cookie value

[martijnboland]

I've had an issue where I wanted to store a serialized json array in a cookie. This is not allowed anymore because of the comma that appears in the serialized representation (e.g. "["value 1","value 2"]").
Comma's are indeed not supported in cookies, but in the past (System.Web, Owin), these were always encoded and this does not seem to be the case anymore.

I wonder, should we encode and decode these values ourselves or should the framework do that automatically.

[Tratcher]

This is for httpContext.Response.Cookies.Append(key, value); correct?

[martijnboland]

Yes

[muratg]

Moving this to Backlog as we will be in RC2 ask mode very soon. If you feel strongly about this issue, please ping me.

[brockallen]

Yes, this seems like an important issue to understand why it's happening and get fixed.

[muratg]

Yep, looks like a bug. Though we are crammed on time and we will revisit backlog bugs after RC2.

[CrispinH]

This bug is affecting my use of IdentityServer4 and presumably everyone else's too. Given Dominick Baier's blog post paragraph: "One year ago the ASP.NET team decided to discontinue that middleware and rather focus on consuming tokens instead. They also asked us if IdentityServer can be the replacement going forward." - this is needs fixing.

[Tratcher]

@leastprivilege, can you elaborate on how this affects IdentiyServer?

[brockallen]

We put the client id the user has logged into into a cookie. This is used for single sign out.

[Tratcher]

In a json format? or does the client id happen to contain a comma?

[brockallen]

We serailize to json and it's an array of strings. It's the exact same code in IdentityServer3 and that works under katana :)

Basically, the APIs to add the cookie seem to automatically URL encode the value. In ASP.NET Core it's odd that the value is encoded, but there's a "," left in the middle.

[brockallen]

Here's a link with the sample text that's being put into the cookie: https://github.com/IdentityServer/IdentityServer3/issues/2446#issuecomment-172908822