[Plus symbol issue] - UserAuthenticationTokenService sends requests with 'Content-Type' - 'application/x-www-form-urlencoded'

If a user login or password contains a symbol + it would be replaced with whitespaces 'cause Content-Type is equal to application/x-www-form-urlencoded. As a result, we have problems with users authorization.

Environment Details

• Spartacus: 1.0.4

Steps to Reproduce

• Go to the login page
• Type a login
• Type a password which contains a plus or pluses (e.g. 12345+qq)

Observed Results

All pluses would be replaced with whitespaces when we send form data.

Expected Results

Login and password are sent without changes.

Additional Information

As I can see UserAuthenticationTokenService sends requests with ‘Content-Type’ - ‘application/x-www-form-urlencoded’, Probably a problem is here.

https://spartacus-storefront.slack.com/archives/CD16V16FR/p1566915251244300

[tobi-or-not-tobi]

Thanks @meeque for chiming in on this topic. Angular indeed doesn’t support clean encoding/decoding, which is why we do not get proper encoding for various characters (@:$,;+=?/). I’ve gone through various resources related to this topic, and I’m not sure why these characters are skipped.

We should allow for proper encoding, but not without an option to customise this. My recommendation is to:

• implement a HttpParameterCodec that solely uses the encodeURIComponent and decodeURIComponent from the browser
• use the encoder wherever we use HttpParameters, but at least in the area of creating users and passwords
• allow for overridden this behaviour, either by DI or by configuring a class in the config module

[DENCREAT]

are there any news?