coulomb/user-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

USER-WP-0039: accept Authelia session ids with RFC 6265 cookie characters
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 49s
Details
Account journey acceptance / journeys (push) Successful in 47s
Details

Browse source 
Real Authelia session ids contain '%', '^' and '!'. The narrower check
dropped them, so the Authelia uid always read 'not signed in / unknown'.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
This commit is contained in:
tegwick 2026-10-15 04:49:13 +02:00
parent 468d4c0822
commit 7f1db7189c
2 changed files with 11 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/user_engine/identity_state.py
View file

@ -17,7 +17,9 @@ from urllib.request import HTTPRedirectHandler, Request, build_opener
from user_engine.oidc import cookie_value
_IDENTITY_NAME = re.compile(r"^[A-Za-z0-9._@+-]{1,200}$")
_SESSION_TOKEN = re.compile(r"^[A-Za-z0-9._~+/=-]{1,4096}$")
# RFC 6265 cookie-octet: printable ASCII except space, '"', ',', ';' and '\'.
# Authelia session ids use characters such as '%', '^' and '!'.
_SESSION_TOKEN = re.compile(r"^[\x21\x23-\x2B\x2D-\x3A\x3C-\x5B\x5D-\x7E]{1,4096}$")
_PUBLIC_HOST = re.compile(r"[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)+")
_CLUSTER_HOST = ".svc.cluster.local"