Microsoft.Owin replaces + in cookies with a single space.

[aidapsibr]

This caused me a massive headache when dealing with base64 encoded cookies from FAM/SAM (Ws-Federation in ASP.NET).

I found the specific line of code that does the replacement. I just wanted to get your opinion on including a heads-up in the OWIN hosting of the docs and if it is as nasty of a practice as I think it is?

OwinHelpers.cs

internal static void ParseDelimited(string text, char[] delimiters,
    Action<string, string, object> callback, object state)

Contains:

string name = text.Substring(scanIndex, equalIndex - scanIndex);
string value = text.Substring(equalIndex + 1, delimiterIndex - equalIndex - 1);
callback(
    Uri.UnescapeDataString(name.Replace('+', ' ')),
    Uri.UnescapeDataString(value.Replace('+', ' ')), 
    state);

[aidapsibr]

Opened a matching issue at the CodePlex page for OWIN. https://katanaproject.codeplex.com/workitem/442

[aidapsibr]

This is now an ongoing discussion for ASPNET 5 at aspnet/HttpAbstractions#547

If anyone wants to chime in?

[thecodejunkie]

Not a Nancy bug, so I'll close this. Please look at the provided links (above) if you are interested in the follow-up

Thanks