huahaofeng
/
aspnetcore
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Update default settings for SameSite 

- Need Lax policy for social authentication
- Need None policy for OIDC
This commit is contained in:
John Luo 2017-05-24 17:04:14 -07:00
parent 348cdf9da9
commit c523839078
8 changed files with 49 additions and 45 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -28,4 +28,5 @@ project.lock.json
.build/ .build/
.testPublish/ .testPublish/
/.vs/ /.vs/
.vscode/
global.json global.json

1
samples/OpenIdConnect.AzureAdSample/Program.cs
View File

@ -15,6 +15,7 @@ namespace OpenIdConnect.AzureAdSample
factory.AddFilter("Console", level => level >= LogLevel.Information); factory.AddFilter("Console", level => level >= LogLevel.Information);
}) })
.UseKestrel() .UseKestrel()
.UseUrls("http://localhost:42023")
.UseContentRoot(Directory.GetCurrentDirectory()) .UseContentRoot(Directory.GetCurrentDirectory())
.UseIISIntegration() .UseIISIntegration()
.UseStartup<Startup>() .UseStartup<Startup>()

6
src/Microsoft.AspNetCore.Authentication.Cookies/CookieAuthenticationOptions.cs
View File

@ -22,7 +22,8 @@ namespace Microsoft.AspNetCore.Authentication.Cookies
ReturnUrlParameter = CookieAuthenticationDefaults.ReturnUrlParameter; ReturnUrlParameter = CookieAuthenticationDefaults.ReturnUrlParameter;
ExpireTimeSpan = TimeSpan.FromDays(14); ExpireTimeSpan = TimeSpan.FromDays(14);
SlidingExpiration = true; SlidingExpiration = true;
CookieSameSite = SameSiteMode.Strict; // To support OAuth authentication, a lax mode is required, see https://github.com/aspnet/Security/issues/1231.
CookieSameSite = SameSiteMode.Lax;
CookieHttpOnly = true; CookieHttpOnly = true;
CookieSecure = CookieSecurePolicy.SameAsRequest; CookieSecure = CookieSecurePolicy.SameAsRequest;
Events = new CookieAuthenticationEvents(); Events = new CookieAuthenticationEvents();
@ -59,7 +60,8 @@ namespace Microsoft.AspNetCore.Authentication.Cookies
/// <summary> /// <summary>
/// Determines if the browser should allow the cookie to be attached to same-site or cross-site requests. The /// Determines if the browser should allow the cookie to be attached to same-site or cross-site requests. The
/// default is Strict, which means the cookie is only allowed to be attached to same-site requests. /// default is Lax, which means the cookie is only allowed to be attached to cross-site requests using safe
/// HTTP methods and same-site requests.
/// </summary> /// </summary>
public SameSiteMode CookieSameSite { get; set; } public SameSiteMode CookieSameSite { get; set; }

4
src/Microsoft.AspNetCore.Authentication.OpenIdConnect/OpenIdConnectHandler.cs
View File

@ -892,7 +892,7 @@ namespace Microsoft.AspNetCore.Authentication.OpenIdConnect
new CookieOptions new CookieOptions
{ {
HttpOnly = true, HttpOnly = true,
SameSite = Http.SameSiteMode.Lax, SameSite = Http.SameSiteMode.None,
Secure = Request.IsHttps, Secure = Request.IsHttps,
Expires = Clock.UtcNow.Add(Options.ProtocolValidator.NonceLifetime) Expires = Clock.UtcNow.Add(Options.ProtocolValidator.NonceLifetime)
}); });
@ -924,7 +924,7 @@ namespace Microsoft.AspNetCore.Authentication.OpenIdConnect
var cookieOptions = new CookieOptions var cookieOptions = new CookieOptions
{ {
HttpOnly = true, HttpOnly = true,
SameSite = Http.SameSiteMode.Lax, SameSite = Http.SameSiteMode.None,
Secure = Request.IsHttps Secure = Request.IsHttps
}; };

4
src/Microsoft.AspNetCore.Authentication/RemoteAuthenticationHandler.cs
View File

@ -203,7 +203,7 @@ namespace Microsoft.AspNetCore.Authentication
var cookieOptions = new CookieOptions var cookieOptions = new CookieOptions
{ {
HttpOnly = true, HttpOnly = true,
SameSite = SameSiteMode.Lax, SameSite = SameSiteMode.None,
Secure = Request.IsHttps, Secure = Request.IsHttps,
Expires = Clock.UtcNow.Add(Options.RemoteAuthenticationTimeout), Expires = Clock.UtcNow.Add(Options.RemoteAuthenticationTimeout),
}; };
@ -243,7 +243,7 @@ namespace Microsoft.AspNetCore.Authentication
var cookieOptions = new CookieOptions var cookieOptions = new CookieOptions
{ {
HttpOnly = true, HttpOnly = true,
SameSite = SameSiteMode.Lax, SameSite = SameSiteMode.None,
Secure = Request.IsHttps Secure = Request.IsHttps
}; };
Response.Cookies.Delete(cookieName, cookieOptions); Response.Cookies.Delete(cookieName, cookieOptions);

2
src/Microsoft.AspNetCore.CookiePolicy/CookiePolicyOptions.cs
View File

@ -15,7 +15,7 @@ namespace Microsoft.AspNetCore.Builder
/// <summary> /// <summary>
/// Affects the cookie's same site attribute. /// Affects the cookie's same site attribute.
/// </summary> /// </summary>
public SameSiteMode MinimumSameSitePolicy { get; set; } = SameSiteMode.Strict; public SameSiteMode MinimumSameSitePolicy { get; set; } = SameSiteMode.Lax;
/// <summary> /// <summary>
/// Affects whether cookies must be HttpOnly. /// Affects whether cookies must be HttpOnly.

56
test/Microsoft.AspNetCore.CookiePolicy.Test/CookiePolicyTests.cs
View File

@ -59,10 +59,10 @@ namespace Microsoft.AspNetCore.CookiePolicy.Test
transaction => transaction =>
{ {
Assert.NotNull(transaction.SetCookie); Assert.NotNull(transaction.SetCookie);
Assert.Equal("A=A; path=/; secure; samesite=strict", transaction.SetCookie[0]); Assert.Equal("A=A; path=/; secure; samesite=lax", transaction.SetCookie[0]);
Assert.Equal("B=B; path=/; secure; samesite=strict", transaction.SetCookie[1]); Assert.Equal("B=B; path=/; secure; samesite=lax", transaction.SetCookie[1]);
Assert.Equal("C=C; path=/; secure; samesite=strict", transaction.SetCookie[2]); Assert.Equal("C=C; path=/; secure; samesite=lax", transaction.SetCookie[2]);
Assert.Equal("D=D; path=/; secure; samesite=strict", transaction.SetCookie[3]); Assert.Equal("D=D; path=/; secure; samesite=lax", transaction.SetCookie[3]);
})); }));
} }
@ -79,10 +79,10 @@ namespace Microsoft.AspNetCore.CookiePolicy.Test
transaction => transaction =>
{ {
Assert.NotNull(transaction.SetCookie); Assert.NotNull(transaction.SetCookie);
Assert.Equal("A=A; path=/; samesite=strict", transaction.SetCookie[0]); Assert.Equal("A=A; path=/; samesite=lax", transaction.SetCookie[0]);
Assert.Equal("B=B; path=/; samesite=strict", transaction.SetCookie[1]); Assert.Equal("B=B; path=/; samesite=lax", transaction.SetCookie[1]);
Assert.Equal("C=C; path=/; samesite=strict", transaction.SetCookie[2]); Assert.Equal("C=C; path=/; samesite=lax", transaction.SetCookie[2]);
Assert.Equal("D=D; path=/; secure; samesite=strict", transaction.SetCookie[3]); Assert.Equal("D=D; path=/; secure; samesite=lax", transaction.SetCookie[3]);
})); }));
} }
@ -99,19 +99,19 @@ namespace Microsoft.AspNetCore.CookiePolicy.Test
transaction => transaction =>
{ {
Assert.NotNull(transaction.SetCookie); Assert.NotNull(transaction.SetCookie);
Assert.Equal("A=A; path=/; samesite=strict", transaction.SetCookie[0]); Assert.Equal("A=A; path=/; samesite=lax", transaction.SetCookie[0]);
Assert.Equal("B=B; path=/; samesite=strict", transaction.SetCookie[1]); Assert.Equal("B=B; path=/; samesite=lax", transaction.SetCookie[1]);
Assert.Equal("C=C; path=/; samesite=strict", transaction.SetCookie[2]); Assert.Equal("C=C; path=/; samesite=lax", transaction.SetCookie[2]);
Assert.Equal("D=D; path=/; samesite=strict", transaction.SetCookie[3]); Assert.Equal("D=D; path=/; samesite=lax", transaction.SetCookie[3]);
}), }),
new RequestTest("https://example.com/secureSame", new RequestTest("https://example.com/secureSame",
transaction => transaction =>
{ {
Assert.NotNull(transaction.SetCookie); Assert.NotNull(transaction.SetCookie);
Assert.Equal("A=A; path=/; secure; samesite=strict", transaction.SetCookie[0]); Assert.Equal("A=A; path=/; secure; samesite=lax", transaction.SetCookie[0]);
Assert.Equal("B=B; path=/; secure; samesite=strict", transaction.SetCookie[1]); Assert.Equal("B=B; path=/; secure; samesite=lax", transaction.SetCookie[1]);
Assert.Equal("C=C; path=/; secure; samesite=strict", transaction.SetCookie[2]); Assert.Equal("C=C; path=/; secure; samesite=lax", transaction.SetCookie[2]);
Assert.Equal("D=D; path=/; secure; samesite=strict", transaction.SetCookie[3]); Assert.Equal("D=D; path=/; secure; samesite=lax", transaction.SetCookie[3]);
})); }));
} }
@ -128,10 +128,10 @@ namespace Microsoft.AspNetCore.CookiePolicy.Test
transaction => transaction =>
{ {
Assert.NotNull(transaction.SetCookie); Assert.NotNull(transaction.SetCookie);
Assert.Equal("A=A; path=/; samesite=strict; httponly", transaction.SetCookie[0]); Assert.Equal("A=A; path=/; samesite=lax; httponly", transaction.SetCookie[0]);
Assert.Equal("B=B; path=/; samesite=strict; httponly", transaction.SetCookie[1]); Assert.Equal("B=B; path=/; samesite=lax; httponly", transaction.SetCookie[1]);
Assert.Equal("C=C; path=/; samesite=strict; httponly", transaction.SetCookie[2]); Assert.Equal("C=C; path=/; samesite=lax; httponly", transaction.SetCookie[2]);
Assert.Equal("D=D; path=/; samesite=strict; httponly", transaction.SetCookie[3]); Assert.Equal("D=D; path=/; samesite=lax; httponly", transaction.SetCookie[3]);
})); }));
} }
@ -148,10 +148,10 @@ namespace Microsoft.AspNetCore.CookiePolicy.Test
transaction => transaction =>
{ {
Assert.NotNull(transaction.SetCookie); Assert.NotNull(transaction.SetCookie);
Assert.Equal("A=A; path=/; samesite=strict", transaction.SetCookie[0]); Assert.Equal("A=A; path=/; samesite=lax", transaction.SetCookie[0]);
Assert.Equal("B=B; path=/; samesite=strict", transaction.SetCookie[1]); Assert.Equal("B=B; path=/; samesite=lax", transaction.SetCookie[1]);
Assert.Equal("C=C; path=/; samesite=strict", transaction.SetCookie[2]); Assert.Equal("C=C; path=/; samesite=lax", transaction.SetCookie[2]);
Assert.Equal("D=D; path=/; samesite=strict; httponly", transaction.SetCookie[3]); Assert.Equal("D=D; path=/; samesite=lax; httponly", transaction.SetCookie[3]);
})); }));
} }
@ -242,10 +242,10 @@ namespace Microsoft.AspNetCore.CookiePolicy.Test
var transaction = await server.SendAsync("http://example.com/login"); var transaction = await server.SendAsync("http://example.com/login");
Assert.NotNull(transaction.SetCookie); Assert.NotNull(transaction.SetCookie);
Assert.Equal("Hao=Hao; path=/; samesite=strict", transaction.SetCookie[0]); Assert.Equal("Hao=Hao; path=/; samesite=lax", transaction.SetCookie[0]);
Assert.Equal("Hao=Hao; path=/; samesite=strict", transaction.SetCookie[1]); Assert.Equal("Hao=Hao; path=/; samesite=lax", transaction.SetCookie[1]);
Assert.Equal("Hao=Hao; path=/; samesite=strict", transaction.SetCookie[2]); Assert.Equal("Hao=Hao; path=/; samesite=lax", transaction.SetCookie[2]);
Assert.Equal("Hao=Hao; path=/; secure; samesite=strict", transaction.SetCookie[3]); Assert.Equal("Hao=Hao; path=/; secure; samesite=lax", transaction.SetCookie[3]);
} }
[Fact] [Fact]