diff --git a/etc/k8s/helm-chart/eventhub/charts/account/Chart.yaml b/etc/k8s/helm-chart/eventhub/charts/account/Chart.yaml new file mode 100644 index 0000000..ad4fd58 --- /dev/null +++ b/etc/k8s/helm-chart/eventhub/charts/account/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: account +appVersion: "1.0" +description: EventHub Account Application +version: 1.0.0 +type: application \ No newline at end of file diff --git a/etc/k8s/helm-chart/eventhub/charts/account/templates/account-ingress.yaml b/etc/k8s/helm-chart/eventhub/charts/account/templates/account-ingress.yaml new file mode 100644 index 0000000..19ef867 --- /dev/null +++ b/etc/k8s/helm-chart/eventhub/charts/account/templates/account-ingress.yaml @@ -0,0 +1,18 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: account-ingress + annotations: + nginx.ingress.kubernetes.io/rewrite-target: / +spec: + rules: + - host: "account.openeventhub.com" + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: account + port: + number: 443 \ No newline at end of file diff --git a/etc/k8s/helm-chart/eventhub/charts/account/templates/account-service.yaml b/etc/k8s/helm-chart/eventhub/charts/account/templates/account-service.yaml new file mode 100644 index 0000000..8d843f1 --- /dev/null +++ b/etc/k8s/helm-chart/eventhub/charts/account/templates/account-service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + name: account + name: account +spec: + ports: + - name: "80" + port: 80 + - name: "433" + port: 433 + selector: + app: account diff --git a/etc/k8s/helm-chart/eventhub/charts/account/templates/account.yaml b/etc/k8s/helm-chart/eventhub/charts/account/templates/account.yaml new file mode 100644 index 0000000..a4455c9 --- /dev/null +++ b/etc/k8s/helm-chart/eventhub/charts/account/templates/account.yaml @@ -0,0 +1,22 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: account +spec: + selector: + matchLabels: + app: account + template: + metadata: + labels: + app: account + spec: + containers: + - image: eventhub.account + imagePullPolicy: Never + name: account + ports: + - name: accounthttp + containerPort: 80 + - name: accounthttps + containerPort: 433 \ No newline at end of file diff --git a/src/EventHub.DbMigrator/appsettings.json b/src/EventHub.DbMigrator/appsettings.json index 9073010..07155fd 100644 --- a/src/EventHub.DbMigrator/appsettings.json +++ b/src/EventHub.DbMigrator/appsettings.json @@ -7,16 +7,16 @@ "EventHub_Web": { "ClientId": "EventHub_Web", "ClientSecret": "1q2w3e*", - "RootUrl": "https://localhost:44308" + "RootUrl": "https://openeventhub.com" }, "EventHub_Blazor": { "ClientId": "EventHub_Blazor", - "RootUrl": "https://localhost:44307" + "RootUrl": "https://admin.openeventhub.com" }, "EventHub_Swagger": { "ClientId": "EventHub_Swagger", "ClientSecret": "1q2w3e*", - "RootUrl": "https://localhost:44362" + "RootUrl": "https://api.openeventhub.com" } } } diff --git a/src/EventHub.IdentityServer/Dockerfile b/src/EventHub.IdentityServer/Dockerfile new file mode 100644 index 0000000..20a0003 --- /dev/null +++ b/src/EventHub.IdentityServer/Dockerfile @@ -0,0 +1,4 @@ + FROM mcr.microsoft.com/dotnet/aspnet:5.0 + COPY bin/Release/net5.0/publish/ app/ + WORKDIR /app + ENTRYPOINT ["dotnet", "EventHub.IdentityServer.dll"] \ No newline at end of file diff --git a/src/EventHub.IdentityServer/EventHubIdentityServerModule.cs b/src/EventHub.IdentityServer/EventHubIdentityServerModule.cs index 08898db..f10a1ee 100644 --- a/src/EventHub.IdentityServer/EventHubIdentityServerModule.cs +++ b/src/EventHub.IdentityServer/EventHubIdentityServerModule.cs @@ -139,6 +139,8 @@ namespace EventHub .AllowCredentials(); }); }); + + context.Services.AddSameSiteCookiePolicy(); } public override void OnApplicationInitialization(ApplicationInitializationContext context) @@ -157,6 +159,8 @@ namespace EventHub { app.UseErrorPage(); } + + app.UseCookiePolicy(); app.UseCorrelationId(); app.UseVirtualFiles(); diff --git a/src/EventHub.IdentityServer/Program.cs b/src/EventHub.IdentityServer/Program.cs index ef4acd5..c65563b 100644 --- a/src/EventHub.IdentityServer/Program.cs +++ b/src/EventHub.IdentityServer/Program.cs @@ -20,9 +20,7 @@ namespace EventHub .MinimumLevel.Override("Microsoft.EntityFrameworkCore", LogEventLevel.Warning) .Enrich.FromLogContext() .WriteTo.Async(c => c.File("Logs/logs.txt")) -#if DEBUG .WriteTo.Async(c => c.Console()) -#endif .CreateLogger(); try diff --git a/src/EventHub.IdentityServer/SameSiteCookiesServiceCollectionExtensions.cs b/src/EventHub.IdentityServer/SameSiteCookiesServiceCollectionExtensions.cs new file mode 100644 index 0000000..3b0c754 --- /dev/null +++ b/src/EventHub.IdentityServer/SameSiteCookiesServiceCollectionExtensions.cs @@ -0,0 +1,70 @@ +using Microsoft.AspNetCore.Builder; +using Microsoft.AspNetCore.Http; + +namespace Microsoft.Extensions.DependencyInjection +{ + public static class SameSiteCookiesServiceCollectionExtensions + { + public static IServiceCollection AddSameSiteCookiePolicy(this IServiceCollection services) + { + services.Configure(options => + { + options.MinimumSameSitePolicy = SameSiteMode.Unspecified; + options.OnAppendCookie = cookieContext => + CheckSameSite(cookieContext.Context, cookieContext.CookieOptions); + options.OnDeleteCookie = cookieContext => + CheckSameSite(cookieContext.Context, cookieContext.CookieOptions); + }); + + return services; + } + + private static void CheckSameSite(HttpContext httpContext, CookieOptions options) + { + if (options.SameSite == SameSiteMode.None) + { + var userAgent = httpContext.Request.Headers["User-Agent"].ToString(); + if (!httpContext.Request.IsHttps || DisallowsSameSiteNone(userAgent)) + { + // For .NET Core < 3.1 set SameSite = (SameSiteMode)(-1) + options.SameSite = SameSiteMode.Unspecified; + } + } + } + + private static bool DisallowsSameSiteNone(string userAgent) + { + // Cover all iOS based browsers here. This includes: + // - Safari on iOS 12 for iPhone, iPod Touch, iPad + // - WkWebview on iOS 12 for iPhone, iPod Touch, iPad + // - Chrome on iOS 12 for iPhone, iPod Touch, iPad + // All of which are broken by SameSite=None, because they use the iOS networking stack + if (userAgent.Contains("CPU iPhone OS 12") || userAgent.Contains("iPad; CPU OS 12")) + { + return true; + } + + // Cover Mac OS X based browsers that use the Mac OS networking stack. This includes: + // - Safari on Mac OS X. + // This does not include: + // - Chrome on Mac OS X + // Because they do not use the Mac OS networking stack. + if (userAgent.Contains("Macintosh; Intel Mac OS X 10_14") && + userAgent.Contains("Version/") && userAgent.Contains("Safari")) + { + return true; + } + + // Cover Chrome 50-69, because some versions are broken by SameSite=None, + // and none in this range require it. + // Note: this covers some pre-Chromium Edge versions, + // but pre-Chromium Edge does not require SameSite=None. + if (userAgent.Contains("Chrome/5") || userAgent.Contains("Chrome/6")) + { + return true; + } + + return false; + } + } +} \ No newline at end of file diff --git a/src/EventHub.IdentityServer/appsettings.json b/src/EventHub.IdentityServer/appsettings.json index c9e8b26..d4b0c6a 100644 --- a/src/EventHub.IdentityServer/appsettings.json +++ b/src/EventHub.IdentityServer/appsettings.json @@ -1,14 +1,14 @@ { "App": { - "SelfUrl": "https://localhost:44313", - "CorsOrigins": "https://*.EventHub.com,http://localhost:4200,https://localhost:44307,https://localhost:44362", - "RedirectAllowedUrls": "http://localhost:4200,https://localhost:44307" + "SelfUrl": "https://account.openeventhub.com", + "CorsOrigins": "https://*.openeventhub.com,http://localhost:4200,https://localhost:44307,https://localhost:44362", + "RedirectAllowedUrls": "https://openeventhub.com,https://admin.openeventhub.com" }, "ConnectionStrings": { - "Default": "Host=localhost;Database=EventHub;Username=root;Password=root;Port=5432" + "Default": "Host=postgresql;Port=5435;Database=EventHub;Username=root;Password=root" }, "Redis": { - "Configuration": "127.0.0.1" + "Configuration": "redis" }, "StringEncryption": { "DefaultPassPhrase": "TxVIZFPxK33czbbv"