[SLING-1287] Impersonation cookie must be quoted to support some special characters

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Auth Core 1.0.0
• Fix Version/s: Auth Core 1.0.0
• Component/s: Authentication
• Assignee: Felix Meschberger
• Reporter: Felix Meschberger
• Created: 18/Jan/10 09:01
• Updated: 27/Aug/10 08:50
• Resolved: 20/Jan/10 07:36

Description

The Sling authenticator supports transparent impersonation of another user using a so called "sudo" parameter. Using this parameter causes the authenticator to set a sudo cookie, which is inspected in future requests to decide on whether to further impersonate requests or not.

The problem is, that the character set of cookie values is limited by RFC 2109 defining that a cookie value must be token or quoted-string according
to RFC-2616:

token = 1*<any CHAR except CTLs or separators>
separators = "(" | ")" | "<" | ">" | "@"

","	";"	":"	"\"	<">
"/"	"[" | "]"	"?"	"="
" {" | "} "	SP	HT

quoted-string = ( <"> *(qdtext | quoted-pair ) <"> )
qdtext = <any TEXT except <">>

If the sudo user name contains an "@" sign (such as an email address), the value is not a token any longer and must be properly quoted.