This repository was archived by the owner on Dec 13, 2018. It is now read-only.
Add new CookiePolicy middleware #452
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| // Copyright (c) .NET Foundation. All rights reserved. | ||
| // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. | ||
|
|
||
| using Microsoft.AspNet.Http; | ||
|
|
||
| namespace Microsoft.AspNet.CookiePolicy | ||
| { | ||
| public class AppendCookieContext | ||
| { | ||
| public AppendCookieContext(HttpContext context, CookieOptions options, string name, string value) | ||
| { | ||
| Context = context; | ||
| CookieOptions = options; | ||
| CookieName = name; | ||
| CookieValue = value; | ||
| } | ||
|
|
||
| public HttpContext Context { get; } | ||
| public CookieOptions CookieOptions { get; } | ||
| public string CookieName { get; set; } | ||
| public string CookieValue { get; set; } | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| // Copyright (c) .NET Foundation. All rights reserved. | ||
| // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. | ||
|
|
||
| using System; | ||
| using Microsoft.AspNet.CookiePolicy; | ||
|
|
||
| namespace Microsoft.AspNet.Builder | ||
| { | ||
| /// <summary> | ||
| /// Extension methods provided by the cookie policy middleware | ||
| /// </summary> | ||
| public static class CookiePolicyAppBuilderExtensions | ||
| { | ||
| /// <summary> | ||
| /// Adds a cookie policy middleware to your web application pipeline. | ||
| /// </summary> | ||
| /// <param name="app">The IApplicationBuilder passed to your configuration method</param> | ||
| /// <param name="options">The options for the middleware</param> | ||
| /// <returns>The original app parameter</returns> | ||
| public static IApplicationBuilder UseCookiePolicy(this IApplicationBuilder app, CookiePolicyOptions options) | ||
| { | ||
| return app.UseMiddleware<CookiePolicyMiddleware>(options); | ||
| } | ||
|
|
||
| /// <summary> | ||
| /// Adds a cookie policy middleware to your web application pipeline. | ||
| /// </summary> | ||
| /// <param name="app">The IApplicationBuilder passed to your configuration method</param> | ||
| /// <param name="configureOptions">Used to configure the options for the middleware</param> | ||
| /// <returns>The original app parameter</returns> | ||
| public static IApplicationBuilder UseCookiePolicy(this IApplicationBuilder app, Action<CookiePolicyOptions> configureOptions) | ||
| { | ||
| var options = new CookiePolicyOptions(); | ||
| if (configureOptions != null) | ||
| { | ||
| configureOptions(options); | ||
| } | ||
| return app.UseCookiePolicy(options); | ||
| } | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,157 @@ | ||
| // Copyright (c) .NET Foundation. All rights reserved. | ||
| // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. | ||
|
|
||
| using System.Threading.Tasks; | ||
| using Microsoft.AspNet.Builder; | ||
| using Microsoft.AspNet.Http; | ||
| using Microsoft.AspNet.Http.Features; | ||
| using Microsoft.AspNet.Http.Features.Internal; | ||
|
|
||
| namespace Microsoft.AspNet.CookiePolicy | ||
| { | ||
| public class CookiePolicyMiddleware | ||
| { | ||
| private readonly RequestDelegate _next; | ||
|
|
||
| public CookiePolicyMiddleware( | ||
| RequestDelegate next, | ||
| CookiePolicyOptions options) | ||
| { | ||
| Options = options; | ||
| _next = next; | ||
| } | ||
|
|
||
| public CookiePolicyOptions Options { get; set; } | ||
|
|
||
| public Task Invoke(HttpContext context) | ||
| { | ||
| // REVIEW: Do we need to check if there is a Cookie feature already present like SendFile?? | ||
| context.Features.Set<IResponseCookiesFeature>(new CookiesWrapperFeature(context, Options)); | ||
|
|
||
| return _next(context); | ||
| } | ||
|
|
||
| private class CookiesWrapperFeature : IResponseCookiesFeature | ||
| { | ||
| public CookiesWrapperFeature(HttpContext context, CookiePolicyOptions options) | ||
| { | ||
| Wrapper = new CookiesWrapper(context, options, context.Response.Cookies); | ||
| } | ||
|
|
||
| public IResponseCookies Wrapper { get; } | ||
|
|
||
| public IResponseCookies Cookies | ||
| { | ||
| get | ||
| { | ||
| return Wrapper; | ||
| } | ||
| } | ||
| } | ||
|
|
||
| private class CookiesWrapper : IResponseCookies | ||
| { | ||
| public CookiesWrapper(HttpContext context, CookiePolicyOptions options, IResponseCookies cookies) | ||
| { | ||
| Context = context; | ||
| Cookies = cookies; | ||
| Policy = options; | ||
| } | ||
|
|
||
| public HttpContext Context { get; } | ||
|
|
||
| public IResponseCookies Cookies { get; } | ||
|
|
||
| public CookiePolicyOptions Policy { get; } | ||
|
|
||
| private bool PolicyRequiresCookieOptions() | ||
| { | ||
| return Policy.HttpOnly != HttpOnlyPolicy.None || Policy.Secure != SecurePolicy.None; | ||
| } | ||
|
|
||
| public void Append(string key, string value) | ||
| { | ||
| if (PolicyRequiresCookieOptions()) | ||
| { | ||
| Append(key, value, new CookieOptions()); | ||
| return; | ||
| } | ||
|
|
||
|
|
||
| if (Policy.OnAppendCookie != null) | ||
| { | ||
| var context = new AppendCookieContext(Context, options: null, name: key, value: value); | ||
|
There was a problem hiding this comment. What if they want to add options in the callback? There was a problem hiding this comment. I think you'd always call the other overload if the callback is set. |
||
| Policy.OnAppendCookie(context); | ||
| key = context.CookieName; | ||
| value = context.CookieValue; | ||
| } | ||
| Cookies.Append(key, value); | ||
| } | ||
|
|
||
| public void Append(string key, string value, CookieOptions options) | ||
|
There was a problem hiding this comment. There didn't appear to be any argument validation in the base HttpAbstractions ResponseCookies so I just mimiced that behavior since we are just wrapping no? There was a problem hiding this comment. There's at least a NotNull check on options. |
||
| { | ||
| ApplyPolicy(options); | ||
| if (Policy.OnAppendCookie != null) | ||
| { | ||
| var context = new AppendCookieContext(Context, options, key, value); | ||
| Policy.OnAppendCookie(context); | ||
| key = context.CookieName; | ||
| value = context.CookieValue; | ||
| } | ||
| Cookies.Append(key, value, options); | ||
| } | ||
|
|
||
| public void Delete(string key) | ||
| { | ||
| if (PolicyRequiresCookieOptions()) | ||
| { | ||
| Delete(key, new CookieOptions()); | ||
| return; | ||
| } | ||
|
|
||
|
|
||
|
|
||
| if (Policy.OnDeleteCookie != null) | ||
| { | ||
| var context = new DeleteCookieContext(Context, options: null, name: key); | ||
| Policy.OnDeleteCookie(context); | ||
| key = context.CookieName; | ||
| } | ||
| Cookies.Delete(key); | ||
| } | ||
|
|
||
| public void Delete(string key, CookieOptions options) | ||
| { | ||
| ApplyPolicy(options); | ||
| if (Policy.OnDeleteCookie != null) | ||
| { | ||
| var context = new DeleteCookieContext(Context, options, key); | ||
| Policy.OnDeleteCookie(context); | ||
| key = context.CookieName; | ||
| } | ||
| Cookies.Delete(key, options); | ||
| } | ||
|
|
||
| private void ApplyPolicy(CookieOptions options) | ||
| { | ||
| switch (Policy.Secure) | ||
| { | ||
| case SecurePolicy.Always: | ||
| options.Secure = true; | ||
| break; | ||
| case SecurePolicy.SameAsRequest: | ||
| options.Secure = Context.Request.IsHttps; | ||
| break; | ||
| case SecurePolicy.None: | ||
| break; | ||
| } | ||
| switch (Policy.HttpOnly) | ||
| { | ||
| case HttpOnlyPolicy.Always: | ||
| options.HttpOnly = true; | ||
| break; | ||
| case HttpOnlyPolicy.None: | ||
| break; | ||
| } | ||
|
|
||
| } | ||
| } | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| // Copyright (c) .NET Foundation. All rights reserved. | ||
| // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. | ||
|
|
||
| using System; | ||
|
|
||
| namespace Microsoft.AspNet.CookiePolicy | ||
| { | ||
| public class CookiePolicyOptions | ||
| { | ||
| public HttpOnlyPolicy HttpOnly { get; set; } = HttpOnlyPolicy.None; | ||
| public SecurePolicy Secure { get; set; } = SecurePolicy.None; | ||
|
|
||
| public Action<AppendCookieContext> OnAppendCookie { get; set; } | ||
| public Action<DeleteCookieContext> OnDeleteCookie { get; set; } | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| // Copyright (c) .NET Foundation. All rights reserved. | ||
| // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. | ||
|
|
||
| using Microsoft.AspNet.Http; | ||
|
|
||
| namespace Microsoft.AspNet.CookiePolicy | ||
| { | ||
| public class DeleteCookieContext | ||
| { | ||
| public DeleteCookieContext(HttpContext context, CookieOptions options, string name) | ||
| { | ||
| Context = context; | ||
| CookieOptions = options; | ||
| CookieName = name; | ||
| } | ||
|
|
||
| public HttpContext Context { get; } | ||
| public CookieOptions CookieOptions { get; } | ||
| public string CookieName { get; set; } | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| // Copyright (c) .NET Foundation. All rights reserved. | ||
| // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. | ||
|
|
||
| namespace Microsoft.AspNet.CookiePolicy | ||
| { | ||
| public enum HttpOnlyPolicy | ||
| { | ||
| None, | ||
| Always | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| <?xml version="1.0" encoding="utf-8"?> | ||
| <Project ToolsVersion="14.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> | ||
| <PropertyGroup> | ||
| <VisualStudioVersion Condition="'$(VisualStudioVersion)' == ''">14.0</VisualStudioVersion> | ||
| <VSToolsPath Condition="'$(VSToolsPath)' == ''">$(MSBuildExtensionsPath32)\Microsoft\VisualStudio\v$(VisualStudioVersion)</VSToolsPath> | ||
| </PropertyGroup> | ||
| <Import Project="$(VSToolsPath)\DNX\Microsoft.DNX.Props" Condition="'$(VSToolsPath)' != ''" /> | ||
| <PropertyGroup Label="Globals"> | ||
| <ProjectGuid>86183dc3-02a8-4a68-8b60-71ecec066e79</ProjectGuid> | ||
| <RootNamespace>Microsoft.AspNet.CookiePolicy</RootNamespace> | ||
| <BaseIntermediateOutputPath Condition="'$(BaseIntermediateOutputPath)'=='' ">..\..\artifacts\obj\$(MSBuildProjectName)</BaseIntermediateOutputPath> | ||
| <OutputPath Condition="'$(OutputPath)'=='' ">..\..\artifacts\bin\$(MSBuildProjectName)\</OutputPath> | ||
| </PropertyGroup> | ||
|
|
||
| <PropertyGroup> | ||
| <SchemaVersion>2.0</SchemaVersion> | ||
| </PropertyGroup> | ||
| <Import Project="$(VSToolsPath)\DNX\Microsoft.DNX.targets" Condition="'$(VSToolsPath)' != ''" /> | ||
| </Project> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| // Copyright (c) .NET Foundation. All rights reserved. | ||
| // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. | ||
|
|
||
| using System.Reflection; | ||
| using System.Resources; | ||
|
|
||
| [assembly: AssemblyMetadata("Serviceable", "True")] | ||
| [assembly: NeutralResourcesLanguage("en-us")] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| // Copyright (c) .NET Foundation. All rights reserved. | ||
| // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. | ||
|
|
||
| namespace Microsoft.AspNet.CookiePolicy | ||
| { | ||
| public enum SecurePolicy | ||
| { | ||
| None, | ||
| Always, | ||
| SameAsRequest | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| { | ||
| "version": "1.0.0-*", | ||
| "description": "ASP.NET 5 cookie policy classes.", | ||
| "repository": { | ||
| "type": "git", | ||
| "url": "git://github.com/aspnet/security" | ||
| }, | ||
| "dependencies": { | ||
| "Microsoft.AspNet.Http.Abstractions": "1.0.0-*", | ||
| "Microsoft.AspNet.Http.Features": "1.0.0-*", | ||
|
There was a problem hiding this comment. Remove transitive dependencies on Abstractions, Features. |
||
| "Microsoft.AspNet.Http": "1.0.0-*", | ||
| "Microsoft.Framework.OptionsModel": "1.0.0-*" | ||
| }, | ||
| "frameworks": { | ||
| "dnx451": { }, | ||
| "dnxcore50": { } | ||
| } | ||
| } | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This piece needs review, is it safe to blindly set the feature?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Consider wrapping the existing feature (if any) rather than just wrapping context.Response.Cookies. If none, default to a new ResponseCookiesFeature.