diff --git a/README.md b/README.md index 3ea14d6634..b0430c7868 100644 --- a/README.md +++ b/README.md @@ -7,4 +7,8 @@ Travis: [![Travis](https://travis-ci.org/aspnet/Antiforgery.svg?branch=dev)](h Antiforgery system for generating secure tokens to prevent Cross-Site Request Forgery attacks. -This project is part of ASP.NET Core. You can find samples, documentation and getting started instructions for ASP.NET Core at the [Home](https://github.com/aspnet/home) repo. +This project is part of ASP.NET Core. You can find documentation and getting started instructions for ASP.NET Core at the [Home](https://github.com/aspnet/home) repo. + +Samples can be found in [Entropy](https://github.com/aspnet/Entropy). +The [MVC](https://github.com/aspnet/Entropy/tree/dev/samples/Antiforgery.MvcWithAuthAndAjax) sample shows how to use Antiforgery in MVC when making AJAX requests. +The [Angular](https://github.com/aspnet/Entropy/tree/dev/samples/Antiforgery.Angular1) sample shows how to use Antiforgery with Angular 1. \ No newline at end of file diff --git a/samples/AntiforgerySample/AntiforgerySample.csproj b/samples/AntiforgerySample/AntiforgerySample.csproj deleted file mode 100644 index 44c1f381db..0000000000 --- a/samples/AntiforgerySample/AntiforgerySample.csproj +++ /dev/null @@ -1,24 +0,0 @@ - - - - net451;netcoreapp1.1 - win7-x64 - Exe - 1.2.0-* - - - - - - - - - - - - - - - - - diff --git a/samples/AntiforgerySample/Startup.cs b/samples/AntiforgerySample/Startup.cs deleted file mode 100644 index 1eff1c760d..0000000000 --- a/samples/AntiforgerySample/Startup.cs +++ /dev/null @@ -1,81 +0,0 @@ -// Copyright (c) .NET Foundation. All rights reserved. -// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. - -using System; -using System.IO; -using Microsoft.AspNetCore.Antiforgery; -using Microsoft.AspNetCore.Builder; -using Microsoft.AspNetCore.Hosting; -using Microsoft.AspNetCore.Http; -using Microsoft.Extensions.DependencyInjection; -using Microsoft.Extensions.Options; -using Newtonsoft.Json; - -namespace AntiforgerySample -{ - public class Startup - { - public void ConfigureServices(IServiceCollection services) - { - // Angular's default header name for sending the XSRF token. - services.AddAntiforgery(options => options.HeaderName = "X-XSRF-TOKEN"); - - services.AddSingleton(); - } - - public void Configure(IApplicationBuilder app, IAntiforgery antiforgery, IOptions options, TodoRepository repository) - { - app.Use(next => context => - { - if ( - string.Equals(context.Request.Path.Value, "/", StringComparison.OrdinalIgnoreCase) || - string.Equals(context.Request.Path.Value, "/index.html", StringComparison.OrdinalIgnoreCase)) - { - // We can send the request token as a JavaScript-readable cookie, and Angular will use it by default. - var tokens = antiforgery.GetAndStoreTokens(context); - context.Response.Cookies.Append("XSRF-TOKEN", tokens.RequestToken, new CookieOptions() { HttpOnly = false }); - } - - return next(context); - }); - - app.UseDefaultFiles(); - app.UseStaticFiles(); - - app.Map("/api/items", a => a.Run(async context => - { - if (string.Equals("GET", context.Request.Method, StringComparison.OrdinalIgnoreCase)) - { - var items = repository.GetItems(); - await context.Response.WriteAsync(JsonConvert.SerializeObject(items)); - } - else if (string.Equals("POST", context.Request.Method, StringComparison.OrdinalIgnoreCase)) - { - // This will throw if the token is invalid. - await antiforgery.ValidateRequestAsync(context); - - var serializer = new JsonSerializer(); - using (var reader = new JsonTextReader(new StreamReader(context.Request.Body))) - { - var item = serializer.Deserialize(reader); - repository.Add(item); - } - - context.Response.StatusCode = 204; - } - })); - } - - public static void Main(string[] args) - { - var host = new WebHostBuilder() - .UseKestrel() - .UseIISIntegration() - .UseStartup() - .Build(); - - host.Run(); - } - } -} - diff --git a/samples/AntiforgerySample/TodoItem.cs b/samples/AntiforgerySample/TodoItem.cs deleted file mode 100644 index e58adb37ad..0000000000 --- a/samples/AntiforgerySample/TodoItem.cs +++ /dev/null @@ -1,13 +0,0 @@ -// Copyright (c) .NET Foundation. All rights reserved. -// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. - -using Newtonsoft.Json; - -namespace AntiforgerySample -{ - public class TodoItem - { - [JsonProperty(PropertyName = "name")] - public string Name { get; set; } - } -} diff --git a/samples/AntiforgerySample/TodoRepository.cs b/samples/AntiforgerySample/TodoRepository.cs deleted file mode 100644 index 8625882c0a..0000000000 --- a/samples/AntiforgerySample/TodoRepository.cs +++ /dev/null @@ -1,31 +0,0 @@ -// Copyright (c) .NET Foundation. All rights reserved. -// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. - -using System.Collections.Generic; - -namespace AntiforgerySample -{ - public class TodoRepository - { - private List _items; - - public TodoRepository() - { - _items = new List() - { - new TodoItem() { Name = "Mow the lawn" }, - new TodoItem() { Name = "Do the dishes" }, - }; - } - - public IEnumerable GetItems() - { - return _items; - } - - public void Add(TodoItem item) - { - _items.Add(item); - } - } -} diff --git a/samples/AntiforgerySample/web.config b/samples/AntiforgerySample/web.config deleted file mode 100644 index f7ac679334..0000000000 --- a/samples/AntiforgerySample/web.config +++ /dev/null @@ -1,9 +0,0 @@ - - - - - - - - - \ No newline at end of file diff --git a/samples/AntiforgerySample/wwwroot/Index.html b/samples/AntiforgerySample/wwwroot/Index.html deleted file mode 100644 index 8d130b34c2..0000000000 --- a/samples/AntiforgerySample/wwwroot/Index.html +++ /dev/null @@ -1,47 +0,0 @@ - - - - - - Todo List Antiforgery Sample - - - -
-
-

Todo List Antiforgery Sample

-
-
-
- - - - - - - - - - -
TODO List
{{$index + 1}} - {{item.name}} -
-
-
-
-
-
- - -
- -
-
-
- - - - - - - diff --git a/samples/AntiforgerySample/wwwroot/app.js b/samples/AntiforgerySample/wwwroot/app.js deleted file mode 100644 index f57425a553..0000000000 --- a/samples/AntiforgerySample/wwwroot/app.js +++ /dev/null @@ -1,4 +0,0 @@ -angular.module('TODO', [ - 'TODO.controllers', - 'TODO.services' -]); \ No newline at end of file diff --git a/samples/AntiforgerySample/wwwroot/controllers.js b/samples/AntiforgerySample/wwwroot/controllers.js deleted file mode 100644 index df35c5cab0..0000000000 --- a/samples/AntiforgerySample/wwwroot/controllers.js +++ /dev/null @@ -1,21 +0,0 @@ -angular.module('TODO.controllers', []). -controller('todoController', function ($scope, todoApi) { - $scope.itemList = []; - $scope.item = {}; - - $scope.refresh = function (item) { - todoApi.getItems().success(function (response) { - $scope.itemList = response; - }); - }; - - $scope.create = function (item) { - todoApi.create(item).success(function (response) { - $scope.item = {}; - $scope.refresh(); - }); - }; - - // Load initial items - $scope.refresh(); -}); \ No newline at end of file diff --git a/samples/AntiforgerySample/wwwroot/services.js b/samples/AntiforgerySample/wwwroot/services.js deleted file mode 100644 index be27281ba6..0000000000 --- a/samples/AntiforgerySample/wwwroot/services.js +++ /dev/null @@ -1,22 +0,0 @@ -angular.module('TODO.services', []). - factory('todoApi', function ($http) { - - var todoApi = {}; - - todoApi.getItems = function () { - return $http({ - method: 'GET', - url: '/api/items' - }); - } - - todoApi.create = function (item) { - return $http({ - method: 'POST', - url: '/api/items', - data: item - }); - }; - - return todoApi; - }); \ No newline at end of file diff --git a/test/Microsoft.AspNetCore.Antiforgery.FunctionalTests/AntiForgerySampleTestFixture.cs b/test/Microsoft.AspNetCore.Antiforgery.FunctionalTests/AntiForgerySampleTestFixture.cs deleted file mode 100644 index 5958064a0c..0000000000 --- a/test/Microsoft.AspNetCore.Antiforgery.FunctionalTests/AntiForgerySampleTestFixture.cs +++ /dev/null @@ -1,44 +0,0 @@ -// Copyright (c) .NET Foundation. All rights reserved. -// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. - -using System; -using System.Collections.Generic; -using System.Net.Http; -using Microsoft.AspNetCore.Hosting; -using Microsoft.AspNetCore.TestHost; -using Microsoft.Extensions.Configuration; - -namespace Microsoft.AspNetCore.Antiforgery.FunctionalTests -{ - public class AntiForgerySampleTestFixture : IDisposable - { - private readonly TestServer _server; - - public AntiForgerySampleTestFixture() - { - var configurationBuilder = new ConfigurationBuilder(); - - configurationBuilder.AddInMemoryCollection(new[] - { - new KeyValuePair("webroot", "wwwroot") - }); - - var builder = new WebHostBuilder() - .UseConfiguration(configurationBuilder.Build()) - .UseStartup(typeof(AntiforgerySample.Startup)); - - _server = new TestServer(builder); - - Client = _server.CreateClient(); - Client.BaseAddress = new Uri("http://localhost"); - } - - public HttpClient Client { get; } - - public void Dispose() - { - Client.Dispose(); - _server.Dispose(); - } - } -} diff --git a/test/Microsoft.AspNetCore.Antiforgery.FunctionalTests/AntiforgerySampleTest.cs b/test/Microsoft.AspNetCore.Antiforgery.FunctionalTests/AntiforgerySampleTest.cs deleted file mode 100644 index 52c46bd6b6..0000000000 --- a/test/Microsoft.AspNetCore.Antiforgery.FunctionalTests/AntiforgerySampleTest.cs +++ /dev/null @@ -1,101 +0,0 @@ -// Copyright (c) .NET Foundation. All rights reserved. -// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information. - -using System.Collections.Generic; -using System.Linq; -using System.Net; -using System.Net.Http; -using System.Threading.Tasks; -using Microsoft.Net.Http.Headers; -using Xunit; - -namespace Microsoft.AspNetCore.Antiforgery.FunctionalTests -{ - public class AntiforgerySampleTests : IClassFixture - { - public AntiforgerySampleTests(AntiForgerySampleTestFixture fixture) - { - Client = fixture.Client; - } - - public HttpClient Client { get; } - - [Fact] - public async Task ItemsPage_SetsXSRFTokens() - { - // Arrange & Act - var response = await Client.GetAsync("http://localhost/Index.html"); - - // Assert - var setCookieHeaderValue = RetrieveAntiforgeryCookie(response); - Assert.NotNull(setCookieHeaderValue); - Assert.False(string.IsNullOrEmpty(setCookieHeaderValue.Value)); - Assert.Null(setCookieHeaderValue.Domain); - Assert.Equal("/", setCookieHeaderValue.Path); - Assert.False(setCookieHeaderValue.Secure); - - setCookieHeaderValue = RetrieveAntiforgeryToken(response); - Assert.NotNull(setCookieHeaderValue); - Assert.False(string.IsNullOrEmpty(setCookieHeaderValue.Value)); - Assert.Null(setCookieHeaderValue.Domain); - Assert.Equal("/", setCookieHeaderValue.Path); - Assert.False(setCookieHeaderValue.Secure); - } - - [Fact] - public async Task PostItem_NeedsHeader() - { - // Arrange - var httpResponse = await Client.GetAsync("http://localhost"); - var cookie = RetrieveAntiforgeryCookie(httpResponse); - - var httpRequestMessage = new HttpRequestMessage(HttpMethod.Post, "http://localhost/api/items"); - - // Act - var exception = await Assert.ThrowsAsync(async () => - { - var response = await Client.SendAsync(httpRequestMessage); - }); - - // Assert - Assert.Contains($"The required antiforgery cookie \"{cookie.Name}\" is not present.", exception.Message); - } - - [Fact] - public async Task PostItem_XSRFWorks() - { - // Arrange - var httpResponse = await Client.GetAsync("/Index.html"); - - var cookie = RetrieveAntiforgeryCookie(httpResponse); - var token = RetrieveAntiforgeryToken(httpResponse); - - var httpRequestMessage = new HttpRequestMessage(HttpMethod.Post, "http://localhost/api/items"); - - httpRequestMessage.Headers.Add("Cookie", $"{cookie.Name}={cookie.Value}"); - httpRequestMessage.Headers.Add("X-XSRF-TOKEN", token.Value); - - // Act - var response = await Client.SendAsync(httpRequestMessage); - - // Assert - Assert.Equal(HttpStatusCode.NoContent, response.StatusCode); - } - - private static SetCookieHeaderValue RetrieveAntiforgeryToken(HttpResponseMessage response) - { - return response.Headers.GetValues(HeaderNames.SetCookie) - .Select(setCookieValue => SetCookieHeaderValue.Parse(setCookieValue)) - .Where(setCookieHeaderValue => setCookieHeaderValue.Name == "XSRF-TOKEN") - .FirstOrDefault(); - } - - private static SetCookieHeaderValue RetrieveAntiforgeryCookie(HttpResponseMessage response) - { - return response.Headers.GetValues(HeaderNames.SetCookie) - .Select(setCookieValue => SetCookieHeaderValue.Parse(setCookieValue)) - .Where(setCookieHeaderValue => setCookieHeaderValue.Name.StartsWith(".AspNetCore.Antiforgery.")) - .FirstOrDefault(); - } - } -} \ No newline at end of file diff --git a/test/Microsoft.AspNetCore.Antiforgery.FunctionalTests/Microsoft.AspNetCore.Antiforgery.FunctionalTests.csproj b/test/Microsoft.AspNetCore.Antiforgery.FunctionalTests/Microsoft.AspNetCore.Antiforgery.FunctionalTests.csproj deleted file mode 100644 index 34e281b1bb..0000000000 --- a/test/Microsoft.AspNetCore.Antiforgery.FunctionalTests/Microsoft.AspNetCore.Antiforgery.FunctionalTests.csproj +++ /dev/null @@ -1,21 +0,0 @@ - - - - - - netcoreapp1.1;net451 - win7-x64 - false - false - - - - - - - - - - - -