Merge pull request #6649 from abpframework/liangshiwei/swagger

Swagger UI: Set AntiForgeryToken every time

framework/src/Volo.Abp.Swashbuckle/Microsoft/AspNetCore/Builder/AbpSwaggerUIBuilderExtensions.cs

@@ -15,7 +15,7 @@ namespace Microsoft.AspNetCore.Builder
 
             return app.UseSwaggerUI(options =>
             {
-                options.InjectJavascript("/libs/abp/core/abp.js");
+                options.InjectJavascript("/swagger/ui/abp.js");
                 options.InjectJavascript("/swagger/ui/abp.swagger.js");
                 options.IndexStream = () => resolver.Resolver();
 

framework/src/Volo.Abp.Swashbuckle/Volo.Abp.Swashbuckle.csproj

@@ -4,7 +4,7 @@
     <Import Project="..\..\..\common.props" />
 
     <PropertyGroup>
-        <TargetFramework>netstandard2.0</TargetFramework>
+        <TargetFramework>net5</TargetFramework>
         <AssemblyName>Volo.Abp.Swashbuckle</AssemblyName>
         <PackageId>Volo.Abp.Swashbuckle</PackageId>
         <AssetTargetFallback>$(AssetTargetFallback);portable-net45+win8+wp8+wpa81;</AssetTargetFallback>
@@ -19,12 +19,15 @@
     </ItemGroup>
 
     <ItemGroup>
+      <ProjectReference Include="..\Volo.Abp.AspNetCore.Mvc\Volo.Abp.AspNetCore.Mvc.csproj" />
       <ProjectReference Include="..\Volo.Abp.VirtualFileSystem\Volo.Abp.VirtualFileSystem.csproj" />
     </ItemGroup>
 
     <ItemGroup>
       <None Remove="wwwroot\swagger\ui\abp.swagger.js" />
       <EmbeddedResource Include="wwwroot\swagger\ui\abp.swagger.js" />
+      <None Remove="wwwroot\swagger\ui\abp.js" />
+      <EmbeddedResource Include="wwwroot\swagger\ui\abp.js" />
     </ItemGroup>
 
 </Project>

framework/src/Volo.Abp.Swashbuckle/Volo/Abp/Swashbuckle/AbpSwashbuckleController.cs

@@ -0,0 +1,28 @@
+using Microsoft.AspNetCore.Mvc;
+using Volo.Abp.AspNetCore.Mvc;
+using Volo.Abp.AspNetCore.Mvc.AntiForgery;
+using Volo.Abp.Auditing;
+
+namespace Volo.Abp.Swashbuckle
+{
+    [Area("Abp")]
+    [Route("Abp/Swashbuckle/[action]")]
+    [DisableAuditing]
+    [RemoteService(false)]
+    [ApiExplorerSettings(IgnoreApi = true)]
+    public class AbpSwashbuckleController : AbpController
+    {
+        private readonly IAbpAntiForgeryManager _antiForgeryManager;
+
+        public AbpSwashbuckleController(IAbpAntiForgeryManager antiForgeryManager)
+        {
+            _antiForgeryManager = antiForgeryManager;
+        }
+
+        [HttpGet]
+        public void SetCsrfCookie()
+        {
+            _antiForgeryManager.SetCookie();
+        }
+    }
+}

framework/src/Volo.Abp.Swashbuckle/Volo/Abp/Swashbuckle/AbpSwashbuckleModule.cs

@@ -1,9 +1,12 @@
-using Volo.Abp.Modularity;
+using Volo.Abp.AspNetCore.Mvc;
+using Volo.Abp.Modularity;
 using Volo.Abp.VirtualFileSystem;
 
 namespace Volo.Abp.Swashbuckle
 {
-    [DependsOn(typeof(AbpVirtualFileSystemModule))]
+    [DependsOn(
+        typeof(AbpVirtualFileSystemModule),
+        typeof(AbpAspNetCoreMvcModule))]
     public class AbpSwashbuckleModule : AbpModule
     {
         public override void ConfigureServices(ServiceConfigurationContext context)

framework/src/Volo.Abp.Swashbuckle/wwwroot/swagger/ui/abp.js

@@ -0,0 +1,97 @@
+var abp = abp || {};
+(function () {
+
+    /* Application paths *****************************************/
+
+    //Current application root path (including virtual directory if exists).
+    abp.appPath = abp.appPath || '/';
+
+    /* UTILS ***************************************************/
+
+    abp.utils = abp.utils || {};
+
+    /**
+     * Sets a cookie value for given key.
+     * This is a simple implementation created to be used by ABP.
+     * Please use a complete cookie library if you need.
+     * @param {string} key
+     * @param {string} value
+     * @param {Date} expireDate (optional). If not specified the cookie will expire at the end of session.
+     * @param {string} path (optional)
+     */
+    abp.utils.setCookieValue = function (key, value, expireDate, path) {
+        var cookieValue = encodeURIComponent(key) + '=';
+
+        if (value) {
+            cookieValue = cookieValue + encodeURIComponent(value);
+        }
+
+        if (expireDate) {
+            cookieValue = cookieValue + "; expires=" + expireDate.toUTCString();
+        }
+
+        if (path) {
+            cookieValue = cookieValue + "; path=" + path;
+        }
+
+        document.cookie = cookieValue;
+    };
+
+    /**
+     * Gets a cookie with given key.
+     * This is a simple implementation created to be used by ABP.
+     * Please use a complete cookie library if you need.
+     * @param {string} key
+     * @returns {string} Cookie value or null
+     */
+    abp.utils.getCookieValue = function (key) {
+        var equalities = document.cookie.split('; ');
+        for (var i = 0; i < equalities.length; i++) {
+            if (!equalities[i]) {
+                continue;
+            }
+
+            var splitted = equalities[i].split('=');
+            if (splitted.length != 2) {
+                continue;
+            }
+
+            if (decodeURIComponent(splitted[0]) === key) {
+                return decodeURIComponent(splitted[1] || '');
+            }
+        }
+
+        return null;
+    };
+
+    /**
+     * Deletes cookie for given key.
+     * This is a simple implementation created to be used by ABP.
+     * Please use a complete cookie library if you need.
+     * @param {string} key
+     * @param {string} path (optional)
+     */
+    abp.utils.deleteCookie = function (key, path) {
+        var cookieValue = encodeURIComponent(key) + '=';
+
+        cookieValue = cookieValue + "; expires=" + (new Date(new Date().getTime() - 86400000)).toUTCString();
+
+        if (path) {
+            cookieValue = cookieValue + "; path=" + path;
+        }
+
+        document.cookie = cookieValue;
+    }
+
+    /* SECURITY ***************************************/
+    abp.security = abp.security || {};
+    abp.security.antiForgery = abp.security.antiForgery || {};
+
+    abp.security.antiForgery.tokenCookieName = 'XSRF-TOKEN';
+    abp.security.antiForgery.tokenHeaderName = 'RequestVerificationToken';
+
+    abp.security.antiForgery.getToken = function () {
+        return abp.utils.getCookieValue(abp.security.antiForgery.tokenCookieName);
+    };
+
+})();

framework/src/Volo.Abp.Swashbuckle/wwwroot/swagger/ui/abp.swagger.js

@@ -1,8 +1,26 @@
 var abp = abp || {};
 
 (function () {
+
     abp.SwaggerUIBundle = function (configObject) {
-        configObject.requestInterceptor = function (request) {
+
+        var excludeUrl = ["swagger.json", "connect/token"]
+        var firstRequest = true;
+        abp.appPath = configObject.baseUrl || abp.appPath;
+
+        configObject.requestInterceptor = async function (request) {
+
+            if(request.url.includes(excludeUrl[1])){
+                firstRequest = true;
+            }
+
+            if(firstRequest && !excludeUrl.some(url => request.url.includes(url)))
+            {
+                await fetch(`${abp.appPath}abp/Swashbuckle/SetCsrfCookie`,{
+                    headers: request.headers
+                });
+                firstRequest = false;
+            }
 
             var antiForgeryToken = abp.security.antiForgery.getToken();
             if (antiForgeryToken) {

templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.Host/MyProjectNameHttpApiHostModule.cs

@@ -207,7 +207,7 @@ namespace MyCompanyName.MyProjectName
             app.UseAuthorization();
 
             app.UseSwagger();
-            app.UseSwaggerUI(options =>
+            app.UseAbpSwaggerUI(options =>
             {
                 options.SwaggerEndpoint("/swagger/v1/swagger.json", "MyProjectName API");