mirror of https://github.com/abpframework/abp.git
Ahmet Çelik
1 week ago
committed by
GitHub
GitHub
8 changed files with 426 additions and 153 deletions
@ -0,0 +1,101 @@ |
|||||
|
using System; |
||||
|
using System.Threading.Tasks; |
||||
|
using Microsoft.AspNetCore.Antiforgery; |
||||
|
using Microsoft.AspNetCore.Http; |
||||
|
using Microsoft.Extensions.DependencyInjection; |
||||
|
using Microsoft.Extensions.Options; |
||||
|
|
||||
|
namespace Volo.Abp.AspNetCore.Mvc.AntiForgery; |
||||
|
|
||||
|
// Wraps the framework IAntiforgery so the antiforgery token's per-user identifier is computed against a
|
||||
|
// normalized principal on every entry point (generation and validation, controllers and Razor Pages,
|
||||
|
// ABP and built-in filters, cookie and bearer). This keeps the same user consistent across schemes whose
|
||||
|
// user id claim carries a different issuer (e.g. "LOCAL AUTHORITY" for the Identity cookie vs. the token
|
||||
|
// authority for a validated JWT or an OIDC cookie).
|
||||
|
public class AbpAntiforgery : IAntiforgery |
||||
|
{ |
||||
|
protected IAntiforgery Inner { get; } |
||||
|
|
||||
|
protected AbpAntiForgeryOptions Options { get; } |
||||
|
|
||||
|
public AbpAntiforgery( |
||||
|
IAntiforgery inner, |
||||
|
IOptions<AbpAntiForgeryOptions> options) |
||||
|
{ |
||||
|
Inner = inner; |
||||
|
Options = options.Value; |
||||
|
} |
||||
|
|
||||
|
public virtual AntiforgeryTokenSet GetAndStoreTokens(HttpContext httpContext) |
||||
|
{ |
||||
|
return WithNormalizedUser(httpContext, () => Inner.GetAndStoreTokens(httpContext)); |
||||
|
} |
||||
|
|
||||
|
public virtual AntiforgeryTokenSet GetTokens(HttpContext httpContext) |
||||
|
{ |
||||
|
return WithNormalizedUser(httpContext, () => Inner.GetTokens(httpContext)); |
||||
|
} |
||||
|
|
||||
|
public virtual Task<bool> IsRequestValidAsync(HttpContext httpContext) |
||||
|
{ |
||||
|
return WithNormalizedUserAsync(httpContext, () => Inner.IsRequestValidAsync(httpContext)); |
||||
|
} |
||||
|
|
||||
|
public virtual Task ValidateRequestAsync(HttpContext httpContext) |
||||
|
{ |
||||
|
return WithNormalizedUserAsync(httpContext, async () => |
||||
|
{ |
||||
|
await Inner.ValidateRequestAsync(httpContext); |
||||
|
return true; |
||||
|
}); |
||||
|
} |
||||
|
|
||||
|
public virtual void SetCookieTokenAndHeader(HttpContext httpContext) |
||||
|
{ |
||||
|
WithNormalizedUser(httpContext, () => |
||||
|
{ |
||||
|
Inner.SetCookieTokenAndHeader(httpContext); |
||||
|
return true; |
||||
|
}); |
||||
|
} |
||||
|
|
||||
|
protected virtual T WithNormalizedUser<T>(HttpContext httpContext, Func<T> action) |
||||
|
{ |
||||
|
if (!Options.NormalizeUserIdClaimIssuer) |
||||
|
{ |
||||
|
return action(); |
||||
|
} |
||||
|
|
||||
|
var normalizer = httpContext.RequestServices.GetRequiredService<IAbpAntiForgeryClaimsPrincipalNormalizer>(); |
||||
|
var originalPrincipal = httpContext.User; |
||||
|
httpContext.User = normalizer.Normalize(originalPrincipal); |
||||
|
try |
||||
|
{ |
||||
|
return action(); |
||||
|
} |
||||
|
finally |
||||
|
{ |
||||
|
httpContext.User = originalPrincipal; |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
protected virtual async Task<T> WithNormalizedUserAsync<T>(HttpContext httpContext, Func<Task<T>> action) |
||||
|
{ |
||||
|
if (!Options.NormalizeUserIdClaimIssuer) |
||||
|
{ |
||||
|
return await action(); |
||||
|
} |
||||
|
|
||||
|
var normalizer = httpContext.RequestServices.GetRequiredService<IAbpAntiForgeryClaimsPrincipalNormalizer>(); |
||||
|
var originalPrincipal = httpContext.User; |
||||
|
httpContext.User = normalizer.Normalize(originalPrincipal); |
||||
|
try |
||||
|
{ |
||||
|
return await action(); |
||||
|
} |
||||
|
finally |
||||
|
{ |
||||
|
httpContext.User = originalPrincipal; |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,182 @@ |
|||||
|
using System; |
||||
|
using System.Security.Claims; |
||||
|
using System.Threading.Tasks; |
||||
|
using Microsoft.AspNetCore.Antiforgery; |
||||
|
using Microsoft.AspNetCore.Http; |
||||
|
using Microsoft.Extensions.DependencyInjection; |
||||
|
using Shouldly; |
||||
|
using Volo.Abp.Security.Claims; |
||||
|
using Xunit; |
||||
|
|
||||
|
namespace Volo.Abp.AspNetCore.Mvc.AntiForgery; |
||||
|
|
||||
|
public class AbpAntiforgery_Tests |
||||
|
{ |
||||
|
private const string BearerIssuer = "https://localhost:44361/"; |
||||
|
private const string UserId = "3a0e6f1c-1111-2222-3333-444455556666"; |
||||
|
|
||||
|
[Fact] |
||||
|
public Task GetAndStoreTokens_should_normalize_the_user_and_restore_it() => |
||||
|
Should_normalize_then_restore( |
||||
|
(antiforgery, httpContext) => { antiforgery.GetAndStoreTokens(httpContext); return Task.CompletedTask; }, |
||||
|
inner => inner.UserSeenByGetAndStoreTokens); |
||||
|
|
||||
|
[Fact] |
||||
|
public Task GetTokens_should_normalize_the_user_and_restore_it() => |
||||
|
Should_normalize_then_restore( |
||||
|
(antiforgery, httpContext) => { antiforgery.GetTokens(httpContext); return Task.CompletedTask; }, |
||||
|
inner => inner.UserSeenByGetTokens); |
||||
|
|
||||
|
[Fact] |
||||
|
public Task IsRequestValidAsync_should_normalize_the_user_and_restore_it() => |
||||
|
Should_normalize_then_restore( |
||||
|
(antiforgery, httpContext) => antiforgery.IsRequestValidAsync(httpContext), |
||||
|
inner => inner.UserSeenByIsRequestValid); |
||||
|
|
||||
|
[Fact] |
||||
|
public Task ValidateRequestAsync_should_normalize_the_user_and_restore_it() => |
||||
|
Should_normalize_then_restore( |
||||
|
(antiforgery, httpContext) => antiforgery.ValidateRequestAsync(httpContext), |
||||
|
inner => inner.UserSeenByValidateRequest); |
||||
|
|
||||
|
[Fact] |
||||
|
public Task SetCookieTokenAndHeader_should_normalize_the_user_and_restore_it() => |
||||
|
Should_normalize_then_restore( |
||||
|
(antiforgery, httpContext) => { antiforgery.SetCookieTokenAndHeader(httpContext); return Task.CompletedTask; }, |
||||
|
inner => inner.UserSeenBySetCookieTokenAndHeader); |
||||
|
|
||||
|
[Fact] |
||||
|
public void Should_delegate_the_result_to_the_inner_antiforgery() |
||||
|
{ |
||||
|
var inner = new RecordingAntiforgery(); |
||||
|
var antiforgery = new AbpAntiforgery(inner, CreateOptions(normalize: true)); |
||||
|
var httpContext = CreateHttpContext(CreatePrincipal(BearerIssuer), withNormalizer: true); |
||||
|
|
||||
|
var tokenSet = antiforgery.GetAndStoreTokens(httpContext); |
||||
|
|
||||
|
tokenSet.RequestToken.ShouldBe(RecordingAntiforgery.RequestToken); |
||||
|
tokenSet.CookieToken.ShouldBe(RecordingAntiforgery.CookieToken); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public void Should_not_normalize_when_disabled() |
||||
|
{ |
||||
|
var inner = new RecordingAntiforgery(); |
||||
|
var antiforgery = new AbpAntiforgery(inner, CreateOptions(normalize: false)); |
||||
|
var original = CreatePrincipal(BearerIssuer); |
||||
|
var httpContext = CreateHttpContext(original, withNormalizer: true); |
||||
|
|
||||
|
antiforgery.GetAndStoreTokens(httpContext); |
||||
|
|
||||
|
// the inner saw the original (un-normalized) principal
|
||||
|
inner.UserSeenByGetAndStoreTokens.ShouldBeSameAs(original); |
||||
|
inner.UserSeenByGetAndStoreTokens!.FindFirst(AbpClaimTypes.UserId)!.Issuer.ShouldBe(BearerIssuer); |
||||
|
httpContext.User.ShouldBeSameAs(original); |
||||
|
} |
||||
|
|
||||
|
[Fact] |
||||
|
public void Should_not_resolve_the_normalizer_service_when_disabled() |
||||
|
{ |
||||
|
// the normalizer is intentionally not registered; the disabled fast-path must not touch RequestServices
|
||||
|
var inner = new RecordingAntiforgery(); |
||||
|
var antiforgery = new AbpAntiforgery(inner, CreateOptions(normalize: false)); |
||||
|
var httpContext = CreateHttpContext(CreatePrincipal(BearerIssuer), withNormalizer: false); |
||||
|
|
||||
|
Should.NotThrow(() => antiforgery.GetAndStoreTokens(httpContext)); |
||||
|
} |
||||
|
|
||||
|
private static async Task Should_normalize_then_restore( |
||||
|
Func<IAntiforgery, HttpContext, Task> invoke, |
||||
|
Func<RecordingAntiforgery, ClaimsPrincipal?> userSeenByInner) |
||||
|
{ |
||||
|
var inner = new RecordingAntiforgery(); |
||||
|
var antiforgery = new AbpAntiforgery(inner, CreateOptions(normalize: true)); |
||||
|
var original = CreatePrincipal(BearerIssuer); |
||||
|
var httpContext = CreateHttpContext(original, withNormalizer: true); |
||||
|
|
||||
|
await invoke(antiforgery, httpContext); |
||||
|
|
||||
|
// the inner ran against the normalized principal
|
||||
|
userSeenByInner(inner)!.FindFirst(AbpClaimTypes.UserId)!.Issuer |
||||
|
.ShouldBe(AbpAntiForgeryClaimsPrincipalNormalizer.UserIdClaimIssuer); |
||||
|
// the original principal is restored after the call
|
||||
|
httpContext.User.ShouldBeSameAs(original); |
||||
|
} |
||||
|
|
||||
|
private static Microsoft.Extensions.Options.IOptions<AbpAntiForgeryOptions> CreateOptions(bool normalize) |
||||
|
{ |
||||
|
return Microsoft.Extensions.Options.Options.Create( |
||||
|
new AbpAntiForgeryOptions { NormalizeUserIdClaimIssuer = normalize }); |
||||
|
} |
||||
|
|
||||
|
private static HttpContext CreateHttpContext(ClaimsPrincipal user, bool withNormalizer) |
||||
|
{ |
||||
|
var services = new ServiceCollection(); |
||||
|
if (withNormalizer) |
||||
|
{ |
||||
|
services.AddTransient<IAbpAntiForgeryClaimsPrincipalNormalizer, AbpAntiForgeryClaimsPrincipalNormalizer>(); |
||||
|
} |
||||
|
|
||||
|
return new DefaultHttpContext |
||||
|
{ |
||||
|
User = user, |
||||
|
RequestServices = services.BuildServiceProvider() |
||||
|
}; |
||||
|
} |
||||
|
|
||||
|
private static ClaimsPrincipal CreatePrincipal(string userIdClaimIssuer) |
||||
|
{ |
||||
|
return new ClaimsPrincipal(new ClaimsIdentity( |
||||
|
new[] |
||||
|
{ |
||||
|
new Claim(AbpClaimTypes.UserId, UserId, ClaimValueTypes.String, userIdClaimIssuer) |
||||
|
}, |
||||
|
"AuthenticationTypes.Federation")); |
||||
|
} |
||||
|
|
||||
|
private sealed class RecordingAntiforgery : IAntiforgery |
||||
|
{ |
||||
|
public const string RequestToken = "test-request-token"; |
||||
|
public const string CookieToken = "test-cookie-token"; |
||||
|
|
||||
|
public ClaimsPrincipal? UserSeenByGetAndStoreTokens { get; private set; } |
||||
|
public ClaimsPrincipal? UserSeenByGetTokens { get; private set; } |
||||
|
public ClaimsPrincipal? UserSeenByIsRequestValid { get; private set; } |
||||
|
public ClaimsPrincipal? UserSeenByValidateRequest { get; private set; } |
||||
|
public ClaimsPrincipal? UserSeenBySetCookieTokenAndHeader { get; private set; } |
||||
|
|
||||
|
public AntiforgeryTokenSet GetAndStoreTokens(HttpContext httpContext) |
||||
|
{ |
||||
|
UserSeenByGetAndStoreTokens = httpContext.User; |
||||
|
return CreateTokenSet(); |
||||
|
} |
||||
|
|
||||
|
public AntiforgeryTokenSet GetTokens(HttpContext httpContext) |
||||
|
{ |
||||
|
UserSeenByGetTokens = httpContext.User; |
||||
|
return CreateTokenSet(); |
||||
|
} |
||||
|
|
||||
|
public Task<bool> IsRequestValidAsync(HttpContext httpContext) |
||||
|
{ |
||||
|
UserSeenByIsRequestValid = httpContext.User; |
||||
|
return Task.FromResult(true); |
||||
|
} |
||||
|
|
||||
|
public Task ValidateRequestAsync(HttpContext httpContext) |
||||
|
{ |
||||
|
UserSeenByValidateRequest = httpContext.User; |
||||
|
return Task.CompletedTask; |
||||
|
} |
||||
|
|
||||
|
public void SetCookieTokenAndHeader(HttpContext httpContext) |
||||
|
{ |
||||
|
UserSeenBySetCookieTokenAndHeader = httpContext.User; |
||||
|
} |
||||
|
|
||||
|
private static AntiforgeryTokenSet CreateTokenSet() |
||||
|
{ |
||||
|
return new AntiforgeryTokenSet(RequestToken, CookieToken, "RequestVerificationToken", "RequestVerificationToken"); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
Loading…
Reference in new issue