ServiceStack/ServiceStack — pull request #153 by yeurch (2012-05-21 23:43:30+00:00)
Title: Fix security issue with basic auth demo implementation in test code

When a request for a secure resource was received with a cookie named `ss-session`, the request filter just checked that the cookie started with `{username}/`. This means that anyone with knowledge of the username could bypass the security mechanism by fabricating a cookie value (e.g. `user/abcdef`).

The change in this commit tracks the GUID used in the ss-session cookie, so that subsequent requests using the cookie to authenticate must provide both the username *AND* the GUID, in the form `{username}/{guid}`.

Each time a request is submitted using the basic auth header (rather than the previously issued cookie), then a new GUID is created which renders the old GUID obsolete.