diff --git a/src/OpenIddict.Server.AspNetCore/OpenIddictServerAspNetCoreHandlers.Authentication.cs b/src/OpenIddict.Server.AspNetCore/OpenIddictServerAspNetCoreHandlers.Authentication.cs index a50125ea..abed35be 100644 --- a/src/OpenIddict.Server.AspNetCore/OpenIddictServerAspNetCoreHandlers.Authentication.cs +++ b/src/OpenIddict.Server.AspNetCore/OpenIddictServerAspNetCoreHandlers.Authentication.cs @@ -18,6 +18,7 @@ using Microsoft.Extensions.Logging; using Microsoft.Extensions.Options; using Microsoft.IdentityModel.JsonWebTokens; using Microsoft.IdentityModel.Tokens; +using Microsoft.Net.Http.Headers; using static OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreConstants; using JsonWebTokenTypes = OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreConstants.JsonWebTokenTypes; @@ -319,50 +320,49 @@ public static partial class OpenIddictServerAspNetCoreHandlers context.Logger.LogInformation(SR.GetResourceString(SR.ID6147), context.RedirectUri, context.Response); - using (var buffer = new MemoryStream()) - using (var writer = new StreamWriter(buffer)) + using var buffer = new MemoryStream(); + using var writer = new StreamWriter(buffer); + + writer.WriteLine(""); + writer.WriteLine(""); + writer.WriteLine("
"); + + // While the redirect_uri parameter should be guarded against unknown values, + // it's still safer to encode it to avoid cross-site scripting attacks + // if the authorization server has a relaxed policy concerning redirect URIs. + writer.WriteLine($@""); - writer.WriteLine(""); - writer.WriteLine(""); - writer.WriteLine(""); - writer.Flush(); + writer.WriteLine(@""); + writer.WriteLine(""); + writer.WriteLine(""); + writer.WriteLine(""); + writer.WriteLine(""); + writer.Flush(); - response.StatusCode = 200; - response.ContentLength = buffer.Length; - response.ContentType = "text/html;charset=UTF-8"; + response.StatusCode = 200; + response.ContentLength = buffer.Length; + response.ContentType = "text/html;charset=UTF-8"; - response.Headers["Cache-Control"] = "no-cache"; - response.Headers["Pragma"] = "no-cache"; - response.Headers["Expires"] = "-1"; + response.Headers[HeaderNames.CacheControl] = "no-cache"; + response.Headers[HeaderNames.Pragma] = "no-cache"; + response.Headers[HeaderNames.Expires] = "-1"; - buffer.Seek(offset: 0, loc: SeekOrigin.Begin); - await buffer.CopyToAsync(response.Body, 4096); - } + buffer.Seek(offset: 0, loc: SeekOrigin.Begin); + await buffer.CopyToAsync(response.Body, 4096); context.HandleRequest(); } diff --git a/src/OpenIddict.Server.Owin/OpenIddictServerOwinHandlers.Authentication.cs b/src/OpenIddict.Server.Owin/OpenIddictServerOwinHandlers.Authentication.cs index 53433098..735ec08d 100644 --- a/src/OpenIddict.Server.Owin/OpenIddictServerOwinHandlers.Authentication.cs +++ b/src/OpenIddict.Server.Owin/OpenIddictServerOwinHandlers.Authentication.cs @@ -312,51 +312,49 @@ public static partial class OpenIddictServerOwinHandlers context.Logger.LogInformation(SR.GetResourceString(SR.ID6147), context.RedirectUri, context.Response); - using (var buffer = new MemoryStream()) - using (var writer = new StreamWriter(buffer)) + using var buffer = new MemoryStream(); + using var writer = new StreamWriter(buffer); + + writer.WriteLine(""); + writer.WriteLine(""); + writer.WriteLine(""); + + // While the redirect_uri parameter should be guarded against unknown values, + // it's still safer to encode it to avoid cross-site scripting attacks + // if the authorization server has a relaxed policy concerning redirect URIs. + writer.WriteLine($@""); - writer.WriteLine(""); - writer.WriteLine(""); - writer.WriteLine(""); - writer.Flush(); + writer.WriteLine(@""); + writer.WriteLine(""); + writer.WriteLine(""); + writer.WriteLine(""); + writer.WriteLine(""); + writer.Flush(); - response.StatusCode = 200; - response.ContentLength = buffer.Length; - response.ContentType = "text/html;charset=UTF-8"; + response.StatusCode = 200; + response.ContentLength = buffer.Length; + response.ContentType = "text/html;charset=UTF-8"; - response.Headers["Cache-Control"] = "no-cache"; - response.Headers["Pragma"] = "no-cache"; - response.Headers["Expires"] = "-1"; + response.Headers[Headers.CacheControl] = "no-cache"; + response.Headers[Headers.Pragma] = "no-cache"; + response.Headers[Headers.Expires] = "-1"; - buffer.Seek(offset: 0, loc: SeekOrigin.Begin); - await buffer.CopyToAsync(response.Body, 4096); - } + buffer.Seek(offset: 0, loc: SeekOrigin.Begin); + await buffer.CopyToAsync(response.Body, 4096); context.HandleRequest(); }