huahaofeng
/
aspnetcore
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Allow absolute uri in authentication properties for cookie auth redirect

This commit is contained in:
Troy Dai 2016-08-11 08:48:47 -07:00
parent 97afe4acc8
commit 4600451dc6
2 changed files with 29 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/Microsoft.AspNetCore.Authentication.Cookies/CookieAuthenticationHandler.cs
View File

@ -320,7 +320,7 @@ namespace Microsoft.AspNetCore.Authentication.Cookies
// 1. properties.RedirectUri // 1. properties.RedirectUri
// 2. query parameter ReturnUrlParameter // 2. query parameter ReturnUrlParameter
var redirectUri = properties.RedirectUri; var redirectUri = properties.RedirectUri;
if (string.IsNullOrEmpty(redirectUri) || !IsHostRelative(redirectUri)) if (string.IsNullOrEmpty(redirectUri))
{ {
redirectUri = Request.Query[Options.ReturnUrlParameter]; redirectUri = Request.Query[Options.ReturnUrlParameter];
if (string.IsNullOrEmpty(redirectUri) || !IsHostRelative(redirectUri)) if (string.IsNullOrEmpty(redirectUri) || !IsHostRelative(redirectUri))

32
test/Microsoft.AspNetCore.Authentication.Test/Cookies/CookieMiddlewareTests.cs
View File

@ -1051,8 +1051,10 @@ namespace Microsoft.AspNetCore.Authentication.Cookies
Assert.Equal("?ReturnUrl=%2F", location.Query); Assert.Equal("?ReturnUrl=%2F", location.Query);
} }
[Fact] [Theory]
public async Task RedirectUriIsHoneredAfterSignin() [InlineData("/redirect_test")]
[InlineData("http://example.com/redirect_to")]
public async Task RedirectUriIsHoneredAfterSignin(string redirectUrl)
{ {
var options = new CookieAuthenticationOptions var options = new CookieAuthenticationOptions
{ {
@ -1065,13 +1067,13 @@ namespace Microsoft.AspNetCore.Authentication.Cookies
await context.Authentication.SignInAsync( await context.Authentication.SignInAsync(
CookieAuthenticationDefaults.AuthenticationScheme, CookieAuthenticationDefaults.AuthenticationScheme,
new ClaimsPrincipal(new ClaimsIdentity(new GenericIdentity("Alice", CookieAuthenticationDefaults.AuthenticationScheme))), new ClaimsPrincipal(new ClaimsIdentity(new GenericIdentity("Alice", CookieAuthenticationDefaults.AuthenticationScheme))),
new AuthenticationProperties { RedirectUri = "/redirect_test" }); new AuthenticationProperties { RedirectUri = redirectUrl });
}); });
var transaction = await SendAsync(server, "http://example.com/testpath"); var transaction = await SendAsync(server, "http://example.com/testpath");
Assert.NotEmpty(transaction.SetCookie); Assert.NotEmpty(transaction.SetCookie);
Assert.Equal(HttpStatusCode.Redirect, transaction.Response.StatusCode); Assert.Equal(HttpStatusCode.Redirect, transaction.Response.StatusCode);
Assert.Equal("/redirect_test", transaction.Response.Headers.Location.ToString()); Assert.Equal(redirectUrl, transaction.Response.Headers.Location.ToString());
} }
[Fact] [Fact]
@ -1097,6 +1099,28 @@ namespace Microsoft.AspNetCore.Authentication.Cookies
Assert.Equal("/ret_path_2", transaction.Response.Headers.Location.ToString()); Assert.Equal("/ret_path_2", transaction.Response.Headers.Location.ToString());
} }
[Fact]
public async Task AbsoluteRedirectUriIsRejected()
{
var options = new CookieAuthenticationOptions
{
LoginPath = "/testpath",
ReturnUrlParameter = "return",
CookieName = "TestCookie"
};
var server = CreateServer(options, async context =>
{
await context.Authentication.SignInAsync(
CookieAuthenticationDefaults.AuthenticationScheme,
new ClaimsPrincipal(new ClaimsIdentity(new GenericIdentity("Alice", CookieAuthenticationDefaults.AuthenticationScheme))));
});
var transaction = await SendAsync(server, "http://example.com/testpath?return=http%3A%2F%2Fexample.com%2Fredirect_to");
Assert.NotEmpty(transaction.SetCookie);
Assert.Equal(HttpStatusCode.OK, transaction.Response.StatusCode);
}
[Fact] [Fact]
public async Task EnsurePrecedenceOfRedirectUriAfterSignin() public async Task EnsurePrecedenceOfRedirectUriAfterSignin()
{ {