Robustly parse quoted WWW-Authenticate parameters
Maintainers usually reply within 2 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 55/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- csharp
- Domain
- authentication, security
Research direction
Locate the ClientOAuthProvider WWW-Authenticate parameter parsing logic and read RFC 9110 sections 11.6.1 and parameter handling first. Verify behavior for commas inside quoted strings and escaped quotes such as \"; done means those values parse without breaking the response handling, with coverage for the edge cases.
Written by the indexing model from the issue text.
Description
Something like param="," can break our naive WWW-Authenticate parameter parsing logic in ClientOAuthProvider. While I don't expect many servers will be sending parameters like that in their responses, and it'd be very unusual for an attacker to have only partial control over a WWW-Authenticate response header value, it'd be best to properly account for things like commas inside of quoted strings or escaped quotes. \".
It's a bit like CSV with its quote handling trickiness.
See https://github.com/modelcontextprotocol/csharp-sdk/pull/1084#discussion_r2612746896 for more context.
https://gist.github.com/halter73/aca998c8855b4260b7ae2e705d85ec98 Includes a copilot conversation I had investigating if there was a built-in API we could leverage, and it appears not.
RFC 9110 contains the relevant specs for the WWW-Authenticate header and how to read a parameter.
https://www.rfc-editor.org/rfc/rfc9110#section-11.6.1
https://www.rfc-editor.org/rfc/rfc9110#parameter
- Dominant language
- C#
- Stars
- 4.5k
- Forks
- 814
- Avg merge
- 8d 7h
- Merged PRs (30d)
- 3
Getting set up
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from modelcontextprotocol/csharp-sdk
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
modelcontextprotocol/csharp-sdk#1867 ·
Maintainers usually reply within 2 days
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
modelcontextprotocol/csharp-sdk#1840 · 1 comment ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
modelcontextprotocol/csharp-sdk#1836 ·
Maintainers usually reply within 2 days
-
enhancement needs confirmation
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
modelcontextprotocol/csharp-sdk#678 · 1 comment ·
Maintainers usually reply within 2 days
-
enhancement needs confirmation P3 ready for work
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
modelcontextprotocol/csharp-sdk#515 · 6 comments · 3 reactions ·
Maintainers usually reply within 2 days
All issues in modelcontextprotocol/csharp-sdk
Similar issues
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
fluentassertions/fluentassertions#3353 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 2/5 Half a day Newbie friendliness 78/100
unoplatform/uno#24769 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
AvaloniaUI/Avalonia#22323 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
microsoft/onnxruntime-genai#2633 ·
Maintainers usually reply within 1 day