tsai
/
abp
mirror of https://github.com/abpframework/abp.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

Check ABP's antiforgery cookie to determine the validation logic.

pull/5728/head
Halil İbrahim Kalkan 6 years ago
parent
104244a05d
commit
e58842c8d6
3 changed files with 25 additions and 23 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 11
      framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryCookieNameProvider.cs
  2. 20
      framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAutoValidateAntiforgeryTokenAuthorizationFilter.cs
  3. 17
      framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpValidateAntiforgeryTokenAuthorizationFilter.cs

11
framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryAuthCookieNameProvider.cs → framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryCookieNameProvider.cs
View File

@ -4,12 +4,12 @@ using Volo.Abp.DependencyInjection;
namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
{
public class AbpAntiForgeryAuthCookieNameProvider : ITransientDependency
public class AbpAntiForgeryCookieNameProvider : ITransientDependency
{
private readonly IOptionsSnapshot<CookieAuthenticationOptions> _namedOptionsAccessor;
private readonly AbpAntiForgeryOptions _abpAntiForgeryOptions;
public AbpAntiForgeryAuthCookieNameProvider(
public AbpAntiForgeryCookieNameProvider(
IOptionsSnapshot<CookieAuthenticationOptions> namedOptionsAccessor,
IOptions<AbpAntiForgeryOptions> abpAntiForgeryOptions)
{
@ -17,9 +17,14 @@ namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
_abpAntiForgeryOptions = abpAntiForgeryOptions.Value;
}
public virtual string GetNameOrNull()
public virtual string GetAuthCookieNameOrNull()
{
return _namedOptionsAccessor.Get(_abpAntiForgeryOptions.AuthCookieSchemaName)?.Cookie?.Name;
}
public virtual string GetAntiForgeryCookieNameOrNull()
{
return _abpAntiForgeryOptions.TokenCookie.Name;
}
}
}

20
framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAutoValidateAntiforgeryTokenAuthorizationFilter.cs
View File

@ -2,29 +2,24 @@ using System;
using Microsoft.AspNetCore.Antiforgery;
using Microsoft.AspNetCore.Mvc.Filters;
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options;
using Volo.Abp.DependencyInjection;
namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
{
public class AbpAutoValidateAntiforgeryTokenAuthorizationFilter : AbpValidateAntiforgeryTokenAuthorizationFilter, ITransientDependency
{
private readonly AntiforgeryOptions _antiforgeryOptions;
private readonly AbpAntiForgeryAuthCookieNameProvider _antiForgeryAuthCookieNameProvider;
private readonly AbpAntiForgeryCookieNameProvider _antiForgeryCookieNameProvider;
public AbpAutoValidateAntiforgeryTokenAuthorizationFilter(
IAntiforgery antiforgery,
IOptions<AntiforgeryOptions> antiforgeryOptions,
AbpAntiForgeryAuthCookieNameProvider antiForgeryAuthCookieNameProvider,
AbpAntiForgeryCookieNameProvider antiForgeryCookieNameProvider,
ILogger<AbpValidateAntiforgeryTokenAuthorizationFilter> logger)
: base(
antiforgery,
antiforgeryOptions,
antiForgeryAuthCookieNameProvider,
antiForgeryCookieNameProvider,
logger)
{
_antiForgeryAuthCookieNameProvider = antiForgeryAuthCookieNameProvider;
_antiforgeryOptions = antiforgeryOptions.Value;
_antiForgeryCookieNameProvider = antiForgeryCookieNameProvider;
}
protected override bool ShouldValidate(AuthorizationFilterContext context)
@ -34,7 +29,7 @@ namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
return false;
}
var authCookieName = _antiForgeryAuthCookieNameProvider.GetNameOrNull();
var authCookieName = _antiForgeryCookieNameProvider.GetAuthCookieNameOrNull();
//Always perform antiforgery validation when request contains authentication cookie
if (authCookieName != null &&
@ -43,10 +38,13 @@ namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
return true;
}
var antiForgeryCookieName = _antiForgeryCookieNameProvider.GetAntiForgeryCookieNameOrNull();
//No need to validate if antiforgery cookie is not sent.
//That means the request is sent from a non-browser client.
//See https://github.com/aspnet/Antiforgery/issues/115
if (!context.HttpContext.Request.Cookies.ContainsKey(_antiforgeryOptions.Cookie.Name))
if (antiForgeryCookieName != null &&
!context.HttpContext.Request.Cookies.ContainsKey(antiForgeryCookieName))
{
return false;
}

17
framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpValidateAntiforgeryTokenAuthorizationFilter.cs
View File

@ -5,7 +5,6 @@ using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.Filters;
using Microsoft.AspNetCore.Mvc.ViewFeatures;
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options;
using Volo.Abp.DependencyInjection;
namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
@ -13,20 +12,17 @@ namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
public class AbpValidateAntiforgeryTokenAuthorizationFilter : IAsyncAuthorizationFilter, IAntiforgeryPolicy, ITransientDependency
{
private IAntiforgery _antiforgery;
private readonly AntiforgeryOptions _antiforgeryOptions;
private readonly AbpAntiForgeryAuthCookieNameProvider _antiForgeryAuthCookieNameProvider;
private readonly AbpAntiForgeryCookieNameProvider _antiForgeryCookieNameProvider;
private readonly ILogger<AbpValidateAntiforgeryTokenAuthorizationFilter> _logger;
public AbpValidateAntiforgeryTokenAuthorizationFilter(
IAntiforgery antiforgery,
IOptions<AntiforgeryOptions> antiforgeryOptions,
AbpAntiForgeryAuthCookieNameProvider antiForgeryAuthCookieNameProvider,
AbpAntiForgeryCookieNameProvider antiForgeryCookieNameProvider,
ILogger<AbpValidateAntiforgeryTokenAuthorizationFilter> logger)
{
_antiforgery = antiforgery;
_antiforgeryOptions = antiforgeryOptions.Value;
_logger = logger;
_antiForgeryAuthCookieNameProvider = antiForgeryAuthCookieNameProvider;
_antiForgeryCookieNameProvider = antiForgeryCookieNameProvider;
}
public async Task OnAuthorizationAsync(AuthorizationFilterContext context)
@ -63,7 +59,7 @@ namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
return false;
}
var authCookieName = _antiForgeryAuthCookieNameProvider.GetNameOrNull();
var authCookieName = _antiForgeryCookieNameProvider.GetAuthCookieNameOrNull();
//Always perform antiforgery validation when request contains authentication cookie
if (authCookieName != null &&
@ -72,10 +68,13 @@ namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
return true;
}
var antiForgeryCookieName = _antiForgeryCookieNameProvider.GetAntiForgeryCookieNameOrNull();
//No need to validate if antiforgery cookie is not sent.
//That means the request is sent from a non-browser client.
//See https://github.com/aspnet/Antiforgery/issues/115
if (!context.HttpContext.Request.Cookies.ContainsKey(_antiforgeryOptions.Cookie.Name))
if (antiForgeryCookieName != null &&
!context.HttpContext.Request.Cookies.ContainsKey(antiForgeryCookieName))
{
return false;
}

Write Preview
Loading…
Cancel
Save