I was taking a look at this. Since the comma is used to split the authorization headers, another separator character should be chosen.

I don't think we can change that part. That would break all existing clients. I don't think we need to change it too, a value can be wrapped in double quotes so we should just not split on the comma inside of quotes.

That makes sense. And is linked to the second point of your list "A value can't start or end with a double quote".

Some quick thoughts (I think I mentioned a few in the start post):

• values not wrapped in a double quote are allowed but can not contain special characters or commas
• values wrapped in double quote can contain anything allowed in a header (ASCII), including a comma
  • the current implementation always strips all doublequotes from start and end of string, even multiples. We will use this existing behavior but use it for something useful
• values may be urlencoded (they will always be urldecoded)
  • this one makes sure we can use special charaters
  • this one might change existing behavior slightly but I consider it "worth it" - it won't break anything
• no html encoding happens in server, a client should escape it

I see. So in order to split the values by commas allowing to have commas inside the value would be something like
parts = authorizationHeader.Split("\",");

I'd say don't use the Split function but write a parser that loops trough all characters instead. That way you can easily add escaping etc.