NancyFx/Nancy — pull request #1526 by provegard (2014-05-07 12:07:07+00:00)
Title: Fix for IndexOutOfRangeException in CookieBasedSessions

When CookieBasedSessions loads a session cookie that was created with a different key, it still tries to build a dictionary before clearing it because the HMAC is invalid. In that process, if the decrypted string (which is bogus given that it was encrypted with a different key) happens to contain a semicolon by chance, the code starts to split it into parts and then key-value pairs. However, it doesn't check that it actually gets an array with two elements before using part[1] => IndexOutOfRangeException.

I added a check to make sure that the code only uses a part as a key-value pair if it truly is one.

This is a fix for #1083