how to decode/encode CAS tickets across HTTP requests ?

[Marvin Addison]

On Tue, Aug 30, 2016 at 6:01 PM Tom Zeller <tzeller at dragonacea.biz> wrote:

> I don't know how it all works, but the Spring UriComponentsBuilder
> doesn't encode query params, AFAIK.
>

Of course it's more complicated than that. Careful reading of RFC 3986
indicates that the Spring component is properly encoding the ticket as a
URI. Specifically, "+", "/", and "=" are allowed in the query portion of a
URI:

query         = *( pchar / "/" / "?" )
pchar         = unreserved / pct-encoded / sub-delims / ":" / "@"
sub-delims    = "!" / "$" / "&" / "'" / "(" / ")" "*" / "+" / "," / ";" /
"="

However, many libraries don't expect those characters in the query part and
expect them to be percent encoded. Explicitly encoding the ticket is the
right thing to do; doesn't hurt any RFC-compliant libs and helps the rest.
I intend to commit a fix and unit test coverage today.

M <dev-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160831/68cc07db/attachment.html>