Port Throw when UseAuthorization is incorrectly configured #14893
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
pranavkm
requested review from
analogrelay,
jkotalik,
SteveSandersonMS and
Tratcher
as code owners
Tratcher
approved these changes
Oct 10, 2019
| @@ -0,0 +1,240 @@ | |||
| // Copyright (c) .NET Foundation. All rights reserved. | |||
mkArtakMSFT
added
Servicing-consider
|
3.0.1 approved ... merge. |
analogrelay
added
Servicing-approved
|
@aspnet/build could you merge this? |
|
Thanks @pranavkm |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Endpoint routing throws if an endpoint requires Auth or Cors middleware to execute but is not configured. #14049 pointed out that this does not throw if the Auth or Cors middleware are configured to execute before the endpoint routing middleware. In this case, an endpoint that requires authorization will run unauthenticated.
This change ports the runtime portion of #14401 to 3.0 to correctly flag this scenario.
Customer Impact
Endpoint routing will throw (result in a 500 response) if an endpoint requires authorization but the middleware is incorrectly configured.
Regression?
No. The middleware is new to 3.0.
Risk
Low. While the impact is very visible as an exception, this prevents an insecure configuration.