tsai
/
openiddict-core
mirror of https://github.com/openiddict/openiddict-core.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

Reintroduce relaxed request paths comparisons

pull/870/head
Kévin Chalet 7 years ago
parent
78637a7d77
commit
7a164b6550
2 changed files with 46 additions and 30 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 38
      src/OpenIddict.Server.AspNetCore/OpenIddictServerAspNetCoreHandlers.cs
  2. 38
      src/OpenIddict.Server.Owin/OpenIddictServerOwinHandlers.cs

38
src/OpenIddict.Server.AspNetCore/OpenIddictServerAspNetCoreHandlers.cs
View File

@ -92,21 +92,21 @@ namespace OpenIddict.Server.AspNetCore
} }
context.EndpointType = context.EndpointType =
Matches(context.Options.AuthorizationEndpointUris) ? OpenIddictServerEndpointType.Authorization : Matches(request, context.Options.AuthorizationEndpointUris) ? OpenIddictServerEndpointType.Authorization :
Matches(context.Options.ConfigurationEndpointUris) ? OpenIddictServerEndpointType.Configuration : Matches(request, context.Options.ConfigurationEndpointUris) ? OpenIddictServerEndpointType.Configuration :
Matches(context.Options.CryptographyEndpointUris) ? OpenIddictServerEndpointType.Cryptography : Matches(request, context.Options.CryptographyEndpointUris) ? OpenIddictServerEndpointType.Cryptography :
Matches(context.Options.DeviceEndpointUris) ? OpenIddictServerEndpointType.Device : Matches(request, context.Options.DeviceEndpointUris) ? OpenIddictServerEndpointType.Device :
Matches(context.Options.IntrospectionEndpointUris) ? OpenIddictServerEndpointType.Introspection : Matches(request, context.Options.IntrospectionEndpointUris) ? OpenIddictServerEndpointType.Introspection :
Matches(context.Options.LogoutEndpointUris) ? OpenIddictServerEndpointType.Logout : Matches(request, context.Options.LogoutEndpointUris) ? OpenIddictServerEndpointType.Logout :
Matches(context.Options.RevocationEndpointUris) ? OpenIddictServerEndpointType.Revocation : Matches(request, context.Options.RevocationEndpointUris) ? OpenIddictServerEndpointType.Revocation :
Matches(context.Options.TokenEndpointUris) ? OpenIddictServerEndpointType.Token : Matches(request, context.Options.TokenEndpointUris) ? OpenIddictServerEndpointType.Token :
Matches(context.Options.UserinfoEndpointUris) ? OpenIddictServerEndpointType.Userinfo : Matches(request, context.Options.UserinfoEndpointUris) ? OpenIddictServerEndpointType.Userinfo :
Matches(context.Options.VerificationEndpointUris) ? OpenIddictServerEndpointType.Verification : Matches(request, context.Options.VerificationEndpointUris) ? OpenIddictServerEndpointType.Verification :
OpenIddictServerEndpointType.Unknown; OpenIddictServerEndpointType.Unknown;
return default; return default;
bool Matches(IList<Uri> addresses) static bool Matches(HttpRequest request, IList<Uri> addresses)
{ {
for (var index = 0; index < addresses.Count; index++) for (var index = 0; index < addresses.Count; index++)
{ {
@ -125,8 +125,7 @@ namespace OpenIddict.Server.AspNetCore
} }
var path = PathString.FromUriComponent(address); var path = PathString.FromUriComponent(address);
if (path == request.PathBase + request.Path || if (AreEquivalent(path, request.PathBase + request.Path))
path == request.PathBase + request.Path + new PathString("/"))
{ {
return true; return true;
} }
@ -135,7 +134,7 @@ namespace OpenIddict.Server.AspNetCore
else if (address.OriginalString.StartsWith("/", StringComparison.OrdinalIgnoreCase)) else if (address.OriginalString.StartsWith("/", StringComparison.OrdinalIgnoreCase))
{ {
var path = new PathString(address.OriginalString); var path = new PathString(address.OriginalString);
if (path == request.Path || path == request.Path + new PathString("/")) if (AreEquivalent(path, request.Path))
{ {
return true; return true;
} }
@ -143,6 +142,15 @@ namespace OpenIddict.Server.AspNetCore
} }
return false; return false;
// ASP.NET Core's routing system ignores trailing slashes when determining
// whether the request path matches a registered route, which is not the case
// with PathString, that treats /connect/token and /connect/token/ as different
// addresses. To mitigate this inconsistency, a manual check is used here.
static bool AreEquivalent(PathString left, PathString right)
=> left.Equals(right, StringComparison.OrdinalIgnoreCase) ||
left.Equals(right + "/", StringComparison.OrdinalIgnoreCase) ||
right.Equals(left + "/", StringComparison.OrdinalIgnoreCase);
} }
} }
} }

38
src/OpenIddict.Server.Owin/OpenIddictServerOwinHandlers.cs
View File

@ -92,21 +92,21 @@ namespace OpenIddict.Server.Owin
} }
context.EndpointType = context.EndpointType =
Matches(context.Options.AuthorizationEndpointUris) ? OpenIddictServerEndpointType.Authorization : Matches(request, context.Options.AuthorizationEndpointUris) ? OpenIddictServerEndpointType.Authorization :
Matches(context.Options.ConfigurationEndpointUris) ? OpenIddictServerEndpointType.Configuration : Matches(request, context.Options.ConfigurationEndpointUris) ? OpenIddictServerEndpointType.Configuration :
Matches(context.Options.CryptographyEndpointUris) ? OpenIddictServerEndpointType.Cryptography : Matches(request, context.Options.CryptographyEndpointUris) ? OpenIddictServerEndpointType.Cryptography :
Matches(context.Options.DeviceEndpointUris) ? OpenIddictServerEndpointType.Device : Matches(request, context.Options.DeviceEndpointUris) ? OpenIddictServerEndpointType.Device :
Matches(context.Options.IntrospectionEndpointUris) ? OpenIddictServerEndpointType.Introspection : Matches(request, context.Options.IntrospectionEndpointUris) ? OpenIddictServerEndpointType.Introspection :
Matches(context.Options.LogoutEndpointUris) ? OpenIddictServerEndpointType.Logout : Matches(request, context.Options.LogoutEndpointUris) ? OpenIddictServerEndpointType.Logout :
Matches(context.Options.RevocationEndpointUris) ? OpenIddictServerEndpointType.Revocation : Matches(request, context.Options.RevocationEndpointUris) ? OpenIddictServerEndpointType.Revocation :
Matches(context.Options.TokenEndpointUris) ? OpenIddictServerEndpointType.Token : Matches(request, context.Options.TokenEndpointUris) ? OpenIddictServerEndpointType.Token :
Matches(context.Options.UserinfoEndpointUris) ? OpenIddictServerEndpointType.Userinfo : Matches(request, context.Options.UserinfoEndpointUris) ? OpenIddictServerEndpointType.Userinfo :
Matches(context.Options.VerificationEndpointUris) ? OpenIddictServerEndpointType.Verification : Matches(request, context.Options.VerificationEndpointUris) ? OpenIddictServerEndpointType.Verification :
OpenIddictServerEndpointType.Unknown; OpenIddictServerEndpointType.Unknown;
return default; return default;
bool Matches(IList<Uri> addresses) static bool Matches(IOwinRequest request, IList<Uri> addresses)
{ {
for (var index = 0; index < addresses.Count; index++) for (var index = 0; index < addresses.Count; index++)
{ {
@ -125,8 +125,7 @@ namespace OpenIddict.Server.Owin
} }
var path = PathString.FromUriComponent(address); var path = PathString.FromUriComponent(address);
if (path == request.PathBase + request.Path || if (AreEquivalent(path, request.PathBase + request.Path))
path == request.PathBase + request.Path + new PathString("/"))
{ {
return true; return true;
} }
@ -135,7 +134,7 @@ namespace OpenIddict.Server.Owin
else if (address.OriginalString.StartsWith("/", StringComparison.OrdinalIgnoreCase)) else if (address.OriginalString.StartsWith("/", StringComparison.OrdinalIgnoreCase))
{ {
var path = new PathString(address.OriginalString); var path = new PathString(address.OriginalString);
if (path == request.Path || path == request.Path + new PathString("/")) if (AreEquivalent(path, request.Path))
{ {
return true; return true;
} }
@ -143,6 +142,15 @@ namespace OpenIddict.Server.Owin
} }
return false; return false;
// ASP.NET MVC's routing system ignores trailing slashes when determining
// whether the request path matches a registered route, which is not the case
// with PathString, that treats /connect/token and /connect/token/ as different
// addresses. To mitigate this inconsistency, a manual check is used here.
static bool AreEquivalent(PathString left, PathString right)
=> left.Equals(right, StringComparison.OrdinalIgnoreCase) ||
left.Equals(right + new PathString("/"), StringComparison.OrdinalIgnoreCase) ||
right.Equals(left + new PathString("/"), StringComparison.OrdinalIgnoreCase);
} }
} }
} }

Write Preview
Loading…
Cancel
Save