diff --git a/src/OpenIddict.Server.AspNetCore/OpenIddictServerAspNetCoreHandlers.Authentication.cs b/src/OpenIddict.Server.AspNetCore/OpenIddictServerAspNetCoreHandlers.Authentication.cs index a50125ea..abed35be 100644 --- a/src/OpenIddict.Server.AspNetCore/OpenIddictServerAspNetCoreHandlers.Authentication.cs +++ b/src/OpenIddict.Server.AspNetCore/OpenIddictServerAspNetCoreHandlers.Authentication.cs @@ -18,6 +18,7 @@ using Microsoft.Extensions.Logging; using Microsoft.Extensions.Options; using Microsoft.IdentityModel.JsonWebTokens; using Microsoft.IdentityModel.Tokens; +using Microsoft.Net.Http.Headers; using static OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreConstants; using JsonWebTokenTypes = OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreConstants.JsonWebTokenTypes; @@ -319,50 +320,49 @@ public static partial class OpenIddictServerAspNetCoreHandlers context.Logger.LogInformation(SR.GetResourceString(SR.ID6147), context.RedirectUri, context.Response); - using (var buffer = new MemoryStream()) - using (var writer = new StreamWriter(buffer)) + using var buffer = new MemoryStream(); + using var writer = new StreamWriter(buffer); + + writer.WriteLine(""); + writer.WriteLine(""); + writer.WriteLine(""); + + // While the redirect_uri parameter should be guarded against unknown values, + // it's still safer to encode it to avoid cross-site scripting attacks + // if the authorization server has a relaxed policy concerning redirect URIs. + writer.WriteLine($@"
"); + + // Note: while initially not allowed by the core OAuth 2.0 specification, multiple parameters + // with the same name are used by derived drafts like the OAuth 2.0 token exchange specification. + // For consistency, multiple parameters with the same name are also supported by this endpoint. + foreach (var (key, value) in + from parameter in context.Response.GetParameters() + let values = (string?[]?) parameter.Value + where values is not null + from value in values + where !string.IsNullOrEmpty(value) + select (parameter.Key, Value: value)) { - writer.WriteLine(""); - writer.WriteLine(""); - writer.WriteLine(""); - - // While the redirect_uri parameter should be guarded against unknown values, - // it's still safer to encode it to avoid cross-site scripting attacks - // if the authorization server has a relaxed policy concerning redirect URIs. - writer.WriteLine($@""); - - // Note: while initially not allowed by the core OAuth 2.0 specification, multiple parameters - // with the same name are used by derived drafts like the OAuth 2.0 token exchange specification. - // For consistency, multiple parameters with the same name are also supported by this endpoint. - foreach (var (key, value) in - from parameter in context.Response.GetParameters() - let values = (string?[]?) parameter.Value - where values is not null - from value in values - where !string.IsNullOrEmpty(value) - select (parameter.Key, Value: value)) - { - writer.WriteLine($@""); - } + writer.WriteLine($@""); + } - writer.WriteLine(@""); - writer.WriteLine("
"); - writer.WriteLine(""); - writer.WriteLine(""); - writer.WriteLine(""); - writer.Flush(); + writer.WriteLine(@""); + writer.WriteLine(""); + writer.WriteLine(""); + writer.WriteLine(""); + writer.WriteLine(""); + writer.Flush(); - response.StatusCode = 200; - response.ContentLength = buffer.Length; - response.ContentType = "text/html;charset=UTF-8"; + response.StatusCode = 200; + response.ContentLength = buffer.Length; + response.ContentType = "text/html;charset=UTF-8"; - response.Headers["Cache-Control"] = "no-cache"; - response.Headers["Pragma"] = "no-cache"; - response.Headers["Expires"] = "-1"; + response.Headers[HeaderNames.CacheControl] = "no-cache"; + response.Headers[HeaderNames.Pragma] = "no-cache"; + response.Headers[HeaderNames.Expires] = "-1"; - buffer.Seek(offset: 0, loc: SeekOrigin.Begin); - await buffer.CopyToAsync(response.Body, 4096); - } + buffer.Seek(offset: 0, loc: SeekOrigin.Begin); + await buffer.CopyToAsync(response.Body, 4096); context.HandleRequest(); } diff --git a/src/OpenIddict.Server.Owin/OpenIddictServerOwinHandlers.Authentication.cs b/src/OpenIddict.Server.Owin/OpenIddictServerOwinHandlers.Authentication.cs index 53433098..735ec08d 100644 --- a/src/OpenIddict.Server.Owin/OpenIddictServerOwinHandlers.Authentication.cs +++ b/src/OpenIddict.Server.Owin/OpenIddictServerOwinHandlers.Authentication.cs @@ -312,51 +312,49 @@ public static partial class OpenIddictServerOwinHandlers context.Logger.LogInformation(SR.GetResourceString(SR.ID6147), context.RedirectUri, context.Response); - using (var buffer = new MemoryStream()) - using (var writer = new StreamWriter(buffer)) + using var buffer = new MemoryStream(); + using var writer = new StreamWriter(buffer); + + writer.WriteLine(""); + writer.WriteLine(""); + writer.WriteLine(""); + + // While the redirect_uri parameter should be guarded against unknown values, + // it's still safer to encode it to avoid cross-site scripting attacks + // if the authorization server has a relaxed policy concerning redirect URIs. + writer.WriteLine($@"
"); + + // Note: while initially not allowed by the core OAuth 2.0 specification, multiple parameters + // with the same name are used by derived drafts like the OAuth 2.0 token exchange specification. + // For consistency, multiple parameters with the same name are also supported by this endpoint. + foreach (var (key, value) in + from parameter in context.Response.GetParameters() + let values = (string?[]?) parameter.Value + where values is not null + from value in values + where !string.IsNullOrEmpty(value) + select (parameter.Key, Value: value)) { - writer.WriteLine(""); - writer.WriteLine(""); - writer.WriteLine(""); - - // While the redirect_uri parameter should be guarded against unknown values - // by OpenIdConnectServerProvider.ValidateAuthorizationRequest, - // it's still safer to encode it to avoid cross-site scripting attacks - // if the authorization server has a relaxed policy concerning redirect URIs. - writer.WriteLine($@""); - - // Note: while initially not allowed by the core OAuth 2.0 specification, multiple parameters - // with the same name are used by derived drafts like the OAuth 2.0 token exchange specification. - // For consistency, multiple parameters with the same name are also supported by this endpoint. - foreach (var (key, value) in - from parameter in context.Response.GetParameters() - let values = (string?[]?) parameter.Value - where values is not null - from value in values - where !string.IsNullOrEmpty(value) - select (parameter.Key, Value: value)) - { - writer.WriteLine($@""); - } + writer.WriteLine($@""); + } - writer.WriteLine(@""); - writer.WriteLine("
"); - writer.WriteLine(""); - writer.WriteLine(""); - writer.WriteLine(""); - writer.Flush(); + writer.WriteLine(@""); + writer.WriteLine(""); + writer.WriteLine(""); + writer.WriteLine(""); + writer.WriteLine(""); + writer.Flush(); - response.StatusCode = 200; - response.ContentLength = buffer.Length; - response.ContentType = "text/html;charset=UTF-8"; + response.StatusCode = 200; + response.ContentLength = buffer.Length; + response.ContentType = "text/html;charset=UTF-8"; - response.Headers["Cache-Control"] = "no-cache"; - response.Headers["Pragma"] = "no-cache"; - response.Headers["Expires"] = "-1"; + response.Headers[Headers.CacheControl] = "no-cache"; + response.Headers[Headers.Pragma] = "no-cache"; + response.Headers[Headers.Expires] = "-1"; - buffer.Seek(offset: 0, loc: SeekOrigin.Begin); - await buffer.CopyToAsync(response.Body, 4096); - } + buffer.Seek(offset: 0, loc: SeekOrigin.Begin); + await buffer.CopyToAsync(response.Body, 4096); context.HandleRequest(); }