This repository has been archived by the owner on Dec 14, 2018. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 2.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Antiforgery goes at the end of filters
- Loading branch information
1 parent
998a47d
commit f02f55c
Showing
16 changed files
with
379 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
45 changes: 45 additions & 0 deletions
45
test/Microsoft.AspNetCore.Mvc.FunctionalTests/AntiforgeryAuthTests.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| // Copyright (c) .NET Foundation. All rights reserved. | ||
| // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. | ||
|
|
||
| using System; | ||
| using System.Net; | ||
| using System.Net.Http; | ||
| using System.Threading.Tasks; | ||
| using SecurityWebSite; | ||
| using Xunit; | ||
|
|
||
| namespace Microsoft.AspNetCore.Mvc.FunctionalTests | ||
| { | ||
| public class AntiforgeryAuthTests : IClassFixture<MvcTestFixture<Startup>> | ||
| { | ||
| public AntiforgeryAuthTests(MvcTestFixture<Startup> fixture) | ||
| { | ||
| Client = fixture.Client; | ||
| } | ||
|
|
||
| public HttpClient Client { get; } | ||
|
|
||
| [Fact] | ||
| public async Task AutomaticAuthenticationBeforeAntiforgery() | ||
| { | ||
| // Arrange & Act | ||
| var response = await Client.PostAsync("http://localhost/Home/AutoAntiforgery", null); | ||
|
|
||
| // Assert | ||
| Assert.Equal(HttpStatusCode.Redirect, response.StatusCode); | ||
| Assert.Equal("/Home/Login", response.Headers.Location.AbsolutePath, StringComparer.OrdinalIgnoreCase); | ||
| } | ||
|
|
||
| [Fact] | ||
| public async Task AuthBeforeAntiforgery() | ||
| { | ||
| // Arrange & Act | ||
| var response = await Client.GetAsync("http://localhost/Home/Antiforgery"); | ||
|
|
||
| // Assert | ||
| // Redirected to login page, Antiforgery didn't fail yet | ||
| Assert.Equal(HttpStatusCode.Redirect, response.StatusCode); | ||
| Assert.Equal("/Home/Login", response.Headers.Location.AbsolutePath, StringComparer.OrdinalIgnoreCase); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
41 changes: 41 additions & 0 deletions
41
test/WebSites/SecurityWebSite/Controllers/HomeController.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| // Copyright (c) .NET Foundation. All rights reserved. | ||
| // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. | ||
|
|
||
| using Microsoft.AspNetCore.Authorization; | ||
| using Microsoft.AspNetCore.Mvc; | ||
|
|
||
| namespace SecurityWebSite.Controllers | ||
| { | ||
| public class HomeController : Controller | ||
| { | ||
| public IActionResult Index() | ||
| { | ||
| return View(); | ||
| } | ||
|
|
||
| [AutoValidateAntiforgeryToken] | ||
| [Authorize] | ||
| [HttpPost] | ||
| public IActionResult AutoAntiforgery() | ||
| { | ||
| return Content("Automaticaly doesn't matter"); | ||
| } | ||
|
|
||
| [Authorize] | ||
| [ValidateAntiForgeryToken] | ||
| public IActionResult Antiforgery() | ||
| { | ||
| return Content("Doesn't matter"); | ||
| } | ||
|
|
||
| public IActionResult Login() | ||
| { | ||
| return Content("Login!"); | ||
| } | ||
|
|
||
| public IActionResult Logout() | ||
| { | ||
| return Content("Logout!"); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| // Copyright (c) .NET Foundation. All rights reserved. | ||
| // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. | ||
|
|
||
| using System.IO; | ||
| using Microsoft.AspNetCore.Hosting; | ||
|
|
||
| namespace SecurityWebSite | ||
| { | ||
| public class Program | ||
| { | ||
| public static void Main(string[] args) | ||
| { | ||
| var host = new WebHostBuilder() | ||
| .UseKestrel() | ||
| .UseContentRoot(Directory.GetCurrentDirectory()) | ||
| .UseStartup<Startup>() | ||
| .Build(); | ||
|
|
||
| host.Run(); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| <?xml version="1.0" encoding="utf-8"?> | ||
| <Project ToolsVersion="14.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> | ||
| <PropertyGroup> | ||
| <VisualStudioVersion Condition="'$(VisualStudioVersion)' == ''">14.0</VisualStudioVersion> | ||
| <VSToolsPath Condition="'$(VSToolsPath)' == ''">$(MSBuildExtensionsPath32)\Microsoft\VisualStudio\v$(VisualStudioVersion)</VSToolsPath> | ||
| </PropertyGroup> | ||
| <Import Project="$(VSToolsPath)\DotNet\Microsoft.DotNet.Props" Condition="'$(VSToolsPath)' != ''" /> | ||
| <PropertyGroup Label="Globals"> | ||
| <ProjectGuid>d28cac79-7004-4b69-993b-edeb4653bfa8</ProjectGuid> | ||
| <RootNamespace>AjaxAntiForgeryValidation</RootNamespace> | ||
| <BaseIntermediateOutputPath Condition="'$(BaseIntermediateOutputPath)'=='' ">.\obj</BaseIntermediateOutputPath> | ||
| <OutputPath Condition="'$(OutputPath)'=='' ">.\bin\</OutputPath> | ||
| <TargetFrameworkVersion>v4.5.2</TargetFrameworkVersion> | ||
| </PropertyGroup> | ||
| <PropertyGroup> | ||
| <SchemaVersion>2.0</SchemaVersion> | ||
| </PropertyGroup> | ||
| <ItemGroup> | ||
| <DnxInvisibleContent Include="bower.json" /> | ||
| <DnxInvisibleContent Include=".bowerrc" /> | ||
| </ItemGroup> | ||
| <Import Project="$(VSToolsPath)\DotNet.Web\Microsoft.DotNet.Web.targets" Condition="'$(VSToolsPath)' != ''" /> | ||
| </Project> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| // Copyright (c) .NET Foundation. All rights reserved. | ||
| // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. | ||
|
|
||
| using Microsoft.AspNetCore.Builder; | ||
| using Microsoft.AspNetCore.Hosting; | ||
| using Microsoft.Extensions.Configuration; | ||
| using Microsoft.Extensions.DependencyInjection; | ||
| using Microsoft.Extensions.Logging; | ||
|
|
||
| namespace SecurityWebSite | ||
| { | ||
| public class Startup | ||
| { | ||
| public Startup(IHostingEnvironment env) | ||
| { | ||
| var builder = new ConfigurationBuilder() | ||
| .SetBasePath(env.ContentRootPath) | ||
| .AddJsonFile("appsettings.json", optional: true, reloadOnChange: true) | ||
| .AddJsonFile($"appsettings.{env.EnvironmentName}.json", optional: true) | ||
| .AddEnvironmentVariables(); | ||
| Configuration = builder.Build(); | ||
| } | ||
|
|
||
| public IConfigurationRoot Configuration { get; } | ||
|
|
||
| // This method gets called by the runtime. Use this method to add services to the container. | ||
| public void ConfigureServices(IServiceCollection services) | ||
| { | ||
| // Add framework services. | ||
| services.AddMvc(); | ||
| services.AddAntiforgery(); | ||
| services.AddAuthentication(); | ||
| } | ||
|
|
||
| // This method gets called by the runtime. Use this method to configure the HTTP request pipeline. | ||
| public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory) | ||
| { | ||
| loggerFactory.AddConsole(Configuration.GetSection("Logging")); | ||
| loggerFactory.AddDebug(); | ||
|
|
||
| if (env.IsDevelopment()) | ||
| { | ||
| app.UseDeveloperExceptionPage(); | ||
| } | ||
|
|
||
| app.UseStaticFiles(); | ||
| app.UseCookieAuthentication(new CookieAuthenticationOptions | ||
| { | ||
| LoginPath = "/Home/Login", | ||
| LogoutPath = "/Home/Logout", | ||
| AutomaticAuthenticate = true, | ||
| AutomaticChallenge = true | ||
| }); | ||
|
|
||
| app.UseMvc(routes => | ||
| { | ||
| routes.MapRoute( | ||
| name: "default", | ||
| template: "{controller=Home}/{action=Index}/{id?}"); | ||
| }); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| @{ | ||
| ViewData["Title"] = "Home Page"; | ||
| } | ||
| <h1>Hello!</h1> | ||
| <script src="https://ajax.aspnetcdn.com/ajax/jQuery/jquery-2.1.4.min.js"></script> | ||
| <script> | ||
| $(document).ready(function () { | ||
| $.ajax({ | ||
| type: "get", | ||
| dataType: "html", | ||
| url: '@Url.Action("Antiforgery", "Home")', | ||
| data: {}, | ||
| success: function (result) { | ||
| alert("We were redirected to login!"); | ||
| }, | ||
| error: function (err, scnd) { | ||
| alert(err.statusText); | ||
| } | ||
| }); | ||
| }); | ||
| </script> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| <!DOCTYPE html> | ||
| <html> | ||
| <head> | ||
| <meta charset="utf-8" /> | ||
| <meta name="viewport" content="width=device-width, initial-scale=1.0" /> | ||
| <title>@ViewData["Title"] - SecurityWebSite</title> | ||
| </head> | ||
| <body> | ||
| <div class="navbar navbar-inverse navbar-fixed-top"> | ||
| <div class="container"> | ||
| <div class="navbar-header"> | ||
| <button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse"> | ||
| <span class="sr-only">Toggle navigation</span> | ||
| <span class="icon-bar"></span> | ||
| <span class="icon-bar"></span> | ||
| <span class="icon-bar"></span> | ||
| </button> | ||
| <a asp-area="" asp-controller="Home" asp-action="Index" class="navbar-brand">SecurityWebSite</a> | ||
| </div> | ||
| <div class="navbar-collapse collapse"> | ||
| <ul class="nav navbar-nav"> | ||
| <li><a asp-area="" asp-controller="Home" asp-action="Index">Home</a></li> | ||
| <li><a asp-area="" asp-controller="Home" asp-action="About">About</a></li> | ||
| <li><a asp-area="" asp-controller="Home" asp-action="Contact">Contact</a></li> | ||
| </ul> | ||
| </div> | ||
| </div> | ||
| </div> | ||
| <div class="container body-content"> | ||
| @RenderBody() | ||
| <hr /> | ||
| <footer> | ||
| <p>© 2016 - SecurityWebSite</p> | ||
| </footer> | ||
| </div> | ||
| </body> | ||
| </html> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| @using SecurityWebSite | ||
| @addTagHelper *, Microsoft.AspNetCore.Mvc.TagHelpers |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| @{ | ||
| Layout = "_Layout"; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| { | ||
| "Logging": { | ||
| "IncludeScopes": false, | ||
| "LogLevel": { | ||
| "Default": "Debug", | ||
| "System": "Information", | ||
| "Microsoft": "Information" | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.