grosser/rack-openid — pull request #4 by Senjai (2014-01-14 00:08:47+00:00)
Title: Ensure response_nonce and sig have no spaces

This is a patch to fix edge cases in which specific openid providers send a malformed query string. Specifically, in some of the requests, the Query string has unescaped + signs which Rack::Request naturally treats as spaces when decoding. However, they have a different meaning in base64, and they're supposed to be escaped to %2B (in which Rack::Request would decode to +'s) which they aren't.

Specifically we've had this issue with Steam and Google openid. An authentication request could fail seemingly randomly in a moderate percentile of requests as the application attempts to process the base64 (openid.sig and openid.response_nonce in the request params) that has spaces in it.

For further discussion see https://github.com/openid/ruby-openid/pull/54

This fixes that issue.