Throw when UseAuthorization is incorrectly configured by pranavkm · Pull Request #14401 · dotnet/aspnetcore

pranavkm · 2019-09-24T22:17:58Z

Update AuthZ & Cors middlewares to only set endpoint routing metadata when
executing in the context of endpoint routing
Add analyzers for incorrect UseAuth use

src/Security/Authorization/Policy/src/AuthorizationMiddleware.cs

JamesNK · 2019-09-24T22:53:14Z

src/Middleware/CORS/src/Infrastructure/CorsMiddleware.cs

-
            var endpoint = context.GetEndpoint();

+            if (endpoint != null)


A comment about why the flag is only set if an endpoint is present

Tratcher · 2019-09-24T23:11:27Z

src/Security/Authorization/Policy/src/AuthorizationMiddleware.cs

+                // Flag to indicate to the system that the middleware was run in the context of endpoint routing.
+                // Setting this flag allows a check in EndpointRoutingMiddleware that verifies if the middleware
+                // pipeline is wired correctly to succeed.
+                context.Items[AuthorizationMiddlewareInvokedKey] = AuthorizationMiddlewareInvokedValue;


Rename key/value to indicate this is endpoint specific.

Do you have any suggestions?

EndpointAuthInvoked?

AuthorizationInvokedWithEndpointsKey?

pranavkm · 2019-09-25T18:26:48Z

🆙 📅

src/Components/test/testassets/TestServer/Startup.cs

src/Components/test/testassets/TestServer/CorsStartup.cs

pranavkm · 2019-09-26T15:45:40Z

@aspnet/build what's up with this error:

Running tests:   'tar' is not recognized as an internal or external command, operable program or batch file.
F:\workspace\_work\1\s\src\Framework\ref\Microsoft.AspNetCore.App.Ref.csproj(179,5): error MSB3073: The command "tar -czf F:\workspace\_work\1\s\artifacts\installers\Release\aspnetcore-targeting-pack-3.1.0-ci.tar.gz ." exited with code 9009.
##[error]src\Framework\ref\Microsoft.AspNetCore.App.Ref.csproj(179,5): error MSB3073: The command "tar -czf F:\workspace\_work\1\s\artifacts\installers\Release\aspnetcore-targeting-pack-3.1.0-ci.tar.gz ." exited with code 9009.

dougbu · 2019-09-26T15:56:48Z

@pranavkm we've asked @MattGal why the Windows version on the Windows agents no longer includes tar. We haven't heard back on this regression.

rynowak · 2019-09-30T19:28:42Z

src/Analyzers/Analyzers/src/UseAuthorizationAnalyzer.cs

+
+            var type = (INamedTypeSymbol)context.Symbol;
+
+            foreach (var middlewareAnalysis in _context.GetRelatedAnalyses<MiddlewareAnalysis>(type))


YSK: this doesn't do control-flow analysis - ie, it's trivial to cause false positives or false negatives when .Map is involved.

Fair enough. We can always recommend turning the analyzer for users where this becomes problematic. Doing flow analysis for this sounds like a lot more effort

rynowak · 2019-09-30T19:30:57Z

src/Analyzers/Analyzers/test/TestFiles/StartupAnalyzerTest/UseAuthFallbackPolicy.cs

+        {
+            // This sort of setup would be useful if the user wants to use Auth for non-endpoint content to be handled using the Fallback policy, while
+            // using the second instance for regular endpoint routing based auth. We do not want to produce a warning in this case.
+            app.UseAuthorization();


I don't super get this - it only makes sense if there's a terminal middleware between here and routing.

I'll toss in a Static files to appear after this.

rynowak · 2019-09-30T19:31:25Z

src/Analyzers/Analyzers/test/TestFiles/StartupAnalyzerTest/UseAuthMultipleTimes.cs

+        public void Configure(IApplicationBuilder app)
+        {
+            app.UseRouting();
+            app.UseAuthorization();


File is called UseAuthMultipleTimes - yet it uses auth a single time. How can this be possible?

src/Http/Routing/test/FunctionalTests/EndpointRoutingIntegrationTest.cs

rynowak · 2019-09-30T19:35:31Z

src/Http/Routing/test/FunctionalTests/EndpointRoutingIntegrationTest.cs

+            {
+                app.UseRouting();
+                app.UseEndpoints(b => b.Map("/", TestDelegate).RequireAuthorization());
+


* Update AuthZ & Cors middlewares to only set endpoint routing metadata when executing in the context of endpoint routing * Add analyzers for incorrect UseAuth use Fixes #14049

pranavkm requested review from Tratcher, analogrelay and jkotalik as code owners September 24, 2019 22:17

pranavkm force-pushed the prkrishn/auth branch from 13f482e to 479c8a9 Compare September 24, 2019 22:19

Eilon added the area-auth Includes: Authn, Authz, OAuth, OIDC, Bearer label Sep 24, 2019

pranavkm requested review from JamesNK and rynowak September 24, 2019 22:41

JamesNK reviewed Sep 24, 2019

View reviewed changes

Tratcher reviewed Sep 24, 2019

View reviewed changes

analogrelay added this to the 3.1.0-preview1 milestone Sep 25, 2019

pranavkm force-pushed the prkrishn/auth branch from bf3e9ab to 63ac5f0 Compare September 25, 2019 18:26

pranavkm requested a review from SteveSandersonMS as a code owner September 25, 2019 22:01

pranavkm commented Sep 25, 2019

View reviewed changes

src/Components/test/testassets/TestServer/Startup.cs Show resolved Hide resolved

src/Components/test/testassets/TestServer/CorsStartup.cs Show resolved Hide resolved

pranavkm modified the milestones: 3.1.0-preview1, 3.1.0-preview2 Sep 30, 2019

rynowak reviewed Sep 30, 2019

View reviewed changes

src/Http/Routing/test/FunctionalTests/EndpointRoutingIntegrationTest.cs Show resolved Hide resolved

rynowak reviewed Sep 30, 2019

View reviewed changes

rynowak approved these changes Sep 30, 2019

View reviewed changes

pranavkm force-pushed the prkrishn/auth branch 2 times, most recently from 3a587df to 219827c Compare October 1, 2019 19:28

pranavkm modified the milestones: 3.1.0-preview2, 3.1.0-preview1 Oct 1, 2019

pranavkm changed the base branch from release/3.1 to release/3.1-preview1 October 1, 2019 20:43

Throw when UseAuthorization is incorrectly configured

5256b76

* Update AuthZ & Cors middlewares to only set endpoint routing metadata when executing in the context of endpoint routing * Add analyzers for incorrect UseAuth use Fixes #14049

pranavkm force-pushed the prkrishn/auth branch from 219827c to 5256b76 Compare October 1, 2019 20:44

mkArtakMSFT merged commit 29a1d50 into release/3.1-preview1 Oct 1, 2019

mkArtakMSFT deleted the prkrishn/auth branch October 1, 2019 23:08

pranavkm mentioned this pull request Oct 10, 2019

Port Throw when UseAuthorization is incorrectly configured #14893

Merged

centreboard mentioned this pull request Oct 20, 2019

Warning about UseAuthorisation appearing in 3.1 #15203

Closed


		var type = (INamedTypeSymbol)context.Symbol;

		foreach (var middlewareAnalysis in _context.GetRelatedAnalyses<MiddlewareAnalysis>(type))

Conversation

pranavkm commented Sep 24, 2019

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pranavkm commented Sep 25, 2019

Uh oh!

Uh oh!

Uh oh!

pranavkm commented Sep 26, 2019

Uh oh!

dougbu commented Sep 26, 2019

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants