Cookie value encoding

[dirk]

Play should URL encode and decode cookie values, so that a value like an email address will not be mangled (because of the @ symbol).

This would require some code like the following in play.server.HttpHandler.parseRequest(), play.server.ServletWrapper.parseRequest() and play.mvc.Http.Response.setCookie():

import org.apache.commons.codec.net.URLCodec;
...
String value = new String(URLCodec.decodeUrl(cookie.value.getBytes("utf-8")), "utf-8");

[dirk (australiandeveloper)]

I'm now using play 1.1 and I've noticed that Netty is being used to encode the cookies.

It seems that Netty does attempt to encode email addresses, but the mechanism is simply to put quotes around the entire value, which doesn't make a lot of sense to me as
- it is not part of the RFC specification
- it doesn't encode the @ symbol into an ASCII compatible value.

I believe the solution that I outlined in the bug report above should solve this problem.

The relevant method in play is
    protected static void addToResponse(Response response, HttpResponse nettyResponse) {
        ...
        for (Http.Cookie cookie : cookies.values()) {
            CookieEncoder encoder = new CookieEncoder(true);
            ...
            nettyResponse.addHeader(SET_COOKIE, encoder.encode());

The netty CookieEncoder class contains a method that puts quotes around any value with certain symbols in it:
    private static void add(StringBuilder sb, String name, String val) {
        ...
        for (int i = 0; i < val.length(); i ++) {
            char c = val.charAt(i);
            switch (c) {
            case '\t': case ' ': case '"': case '(': case ')': case ',':
            case '/': case ':': case ';': case '<': case '=': case '>':
            case '?': case '@': case '[': case '\\': case ']':
            case '{': case '}':
                addQuoted(sb, name, val);
                return;
            }
        }

        addUnquoted(sb, name, val);
    }