huahaofeng
/
aspnetcore
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Update default settings for SameSite 

- Need Lax policy for social authentication
- Need None policy for OIDC
This commit is contained in:
John Luo 2017-05-24 17:04:14 -07:00
parent 348cdf9da9
commit c523839078
8 changed files with 49 additions and 45 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -28,4 +28,5 @@ project.lock.json
.build/
.testPublish/
/.vs/
.vscode/
global.json

1
samples/OpenIdConnect.AzureAdSample/Program.cs
View File

@ -15,6 +15,7 @@ namespace OpenIdConnect.AzureAdSample
factory.AddFilter("Console", level => level >= LogLevel.Information);
})
.UseKestrel()
.UseUrls("http://localhost:42023")
.UseContentRoot(Directory.GetCurrentDirectory())
.UseIISIntegration()
.UseStartup<Startup>()

6
src/Microsoft.AspNetCore.Authentication.Cookies/CookieAuthenticationOptions.cs
View File

@ -22,7 +22,8 @@ namespace Microsoft.AspNetCore.Authentication.Cookies
ReturnUrlParameter = CookieAuthenticationDefaults.ReturnUrlParameter;
ExpireTimeSpan = TimeSpan.FromDays(14);
SlidingExpiration = true;
CookieSameSite = SameSiteMode.Strict;
// To support OAuth authentication, a lax mode is required, see https://github.com/aspnet/Security/issues/1231.
CookieSameSite = SameSiteMode.Lax;
CookieHttpOnly = true;
CookieSecure = CookieSecurePolicy.SameAsRequest;
Events = new CookieAuthenticationEvents();
@ -59,7 +60,8 @@ namespace Microsoft.AspNetCore.Authentication.Cookies
/// <summary>
/// Determines if the browser should allow the cookie to be attached to same-site or cross-site requests. The
/// default is Strict, which means the cookie is only allowed to be attached to same-site requests.
/// default is Lax, which means the cookie is only allowed to be attached to cross-site requests using safe
/// HTTP methods and same-site requests.
/// </summary>
public SameSiteMode CookieSameSite { get; set; }

4
src/Microsoft.AspNetCore.Authentication.OpenIdConnect/OpenIdConnectHandler.cs
View File

@ -892,7 +892,7 @@ namespace Microsoft.AspNetCore.Authentication.OpenIdConnect
new CookieOptions
{
HttpOnly = true,
SameSite = Http.SameSiteMode.Lax,
SameSite = Http.SameSiteMode.None,
Secure = Request.IsHttps,
Expires = Clock.UtcNow.Add(Options.ProtocolValidator.NonceLifetime)
});
@ -924,7 +924,7 @@ namespace Microsoft.AspNetCore.Authentication.OpenIdConnect
var cookieOptions = new CookieOptions
{
HttpOnly = true,
SameSite = Http.SameSiteMode.Lax,
SameSite = Http.SameSiteMode.None,
Secure = Request.IsHttps
};

4
src/Microsoft.AspNetCore.Authentication/RemoteAuthenticationHandler.cs
View File

@ -203,7 +203,7 @@ namespace Microsoft.AspNetCore.Authentication
var cookieOptions = new CookieOptions
{
HttpOnly = true,
SameSite = SameSiteMode.Lax,
SameSite = SameSiteMode.None,
Secure = Request.IsHttps,
Expires = Clock.UtcNow.Add(Options.RemoteAuthenticationTimeout),
};
@ -243,7 +243,7 @@ namespace Microsoft.AspNetCore.Authentication
var cookieOptions = new CookieOptions
{
HttpOnly = true,
SameSite = SameSiteMode.Lax,
SameSite = SameSiteMode.None,
Secure = Request.IsHttps
};
Response.Cookies.Delete(cookieName, cookieOptions);

2
src/Microsoft.AspNetCore.CookiePolicy/CookiePolicyOptions.cs
View File

@ -15,7 +15,7 @@ namespace Microsoft.AspNetCore.Builder
/// <summary>
/// Affects the cookie's same site attribute.
/// </summary>
public SameSiteMode MinimumSameSitePolicy { get; set; } = SameSiteMode.Strict;
public SameSiteMode MinimumSameSitePolicy { get; set; } = SameSiteMode.Lax;
/// <summary>
/// Affects whether cookies must be HttpOnly.

56
test/Microsoft.AspNetCore.CookiePolicy.Test/CookiePolicyTests.cs
View File

@ -59,10 +59,10 @@ namespace Microsoft.AspNetCore.CookiePolicy.Test
transaction =>
{
Assert.NotNull(transaction.SetCookie);
Assert.Equal("A=A; path=/; secure; samesite=strict", transaction.SetCookie[0]);
Assert.Equal("B=B; path=/; secure; samesite=strict", transaction.SetCookie[1]);
Assert.Equal("C=C; path=/; secure; samesite=strict", transaction.SetCookie[2]);
Assert.Equal("D=D; path=/; secure; samesite=strict", transaction.SetCookie[3]);
Assert.Equal("A=A; path=/; secure; samesite=lax", transaction.SetCookie[0]);
Assert.Equal("B=B; path=/; secure; samesite=lax", transaction.SetCookie[1]);
Assert.Equal("C=C; path=/; secure; samesite=lax", transaction.SetCookie[2]);
Assert.Equal("D=D; path=/; secure; samesite=lax", transaction.SetCookie[3]);
}));
}
@ -79,10 +79,10 @@ namespace Microsoft.AspNetCore.CookiePolicy.Test
transaction =>
{
Assert.NotNull(transaction.SetCookie);
Assert.Equal("A=A; path=/; samesite=strict", transaction.SetCookie[0]);
Assert.Equal("B=B; path=/; samesite=strict", transaction.SetCookie[1]);
Assert.Equal("C=C; path=/; samesite=strict", transaction.SetCookie[2]);
Assert.Equal("D=D; path=/; secure; samesite=strict", transaction.SetCookie[3]);
Assert.Equal("A=A; path=/; samesite=lax", transaction.SetCookie[0]);
Assert.Equal("B=B; path=/; samesite=lax", transaction.SetCookie[1]);
Assert.Equal("C=C; path=/; samesite=lax", transaction.SetCookie[2]);
Assert.Equal("D=D; path=/; secure; samesite=lax", transaction.SetCookie[3]);
}));
}
@ -99,19 +99,19 @@ namespace Microsoft.AspNetCore.CookiePolicy.Test
transaction =>
{
Assert.NotNull(transaction.SetCookie);
Assert.Equal("A=A; path=/; samesite=strict", transaction.SetCookie[0]);
Assert.Equal("B=B; path=/; samesite=strict", transaction.SetCookie[1]);
Assert.Equal("C=C; path=/; samesite=strict", transaction.SetCookie[2]);
Assert.Equal("D=D; path=/; samesite=strict", transaction.SetCookie[3]);
Assert.Equal("A=A; path=/; samesite=lax", transaction.SetCookie[0]);
Assert.Equal("B=B; path=/; samesite=lax", transaction.SetCookie[1]);
Assert.Equal("C=C; path=/; samesite=lax", transaction.SetCookie[2]);
Assert.Equal("D=D; path=/; samesite=lax", transaction.SetCookie[3]);
}),
new RequestTest("https://example.com/secureSame",
transaction =>
{
Assert.NotNull(transaction.SetCookie);
Assert.Equal("A=A; path=/; secure; samesite=strict", transaction.SetCookie[0]);
Assert.Equal("B=B; path=/; secure; samesite=strict", transaction.SetCookie[1]);
Assert.Equal("C=C; path=/; secure; samesite=strict", transaction.SetCookie[2]);
Assert.Equal("D=D; path=/; secure; samesite=strict", transaction.SetCookie[3]);
Assert.Equal("A=A; path=/; secure; samesite=lax", transaction.SetCookie[0]);
Assert.Equal("B=B; path=/; secure; samesite=lax", transaction.SetCookie[1]);
Assert.Equal("C=C; path=/; secure; samesite=lax", transaction.SetCookie[2]);
Assert.Equal("D=D; path=/; secure; samesite=lax", transaction.SetCookie[3]);
}));
}
@ -128,10 +128,10 @@ namespace Microsoft.AspNetCore.CookiePolicy.Test
transaction =>
{
Assert.NotNull(transaction.SetCookie);
Assert.Equal("A=A; path=/; samesite=strict; httponly", transaction.SetCookie[0]);
Assert.Equal("B=B; path=/; samesite=strict; httponly", transaction.SetCookie[1]);
Assert.Equal("C=C; path=/; samesite=strict; httponly", transaction.SetCookie[2]);
Assert.Equal("D=D; path=/; samesite=strict; httponly", transaction.SetCookie[3]);
Assert.Equal("A=A; path=/; samesite=lax; httponly", transaction.SetCookie[0]);
Assert.Equal("B=B; path=/; samesite=lax; httponly", transaction.SetCookie[1]);
Assert.Equal("C=C; path=/; samesite=lax; httponly", transaction.SetCookie[2]);
Assert.Equal("D=D; path=/; samesite=lax; httponly", transaction.SetCookie[3]);
}));
}
@ -148,10 +148,10 @@ namespace Microsoft.AspNetCore.CookiePolicy.Test
transaction =>
{
Assert.NotNull(transaction.SetCookie);
Assert.Equal("A=A; path=/; samesite=strict", transaction.SetCookie[0]);
Assert.Equal("B=B; path=/; samesite=strict", transaction.SetCookie[1]);
Assert.Equal("C=C; path=/; samesite=strict", transaction.SetCookie[2]);
Assert.Equal("D=D; path=/; samesite=strict; httponly", transaction.SetCookie[3]);
Assert.Equal("A=A; path=/; samesite=lax", transaction.SetCookie[0]);
Assert.Equal("B=B; path=/; samesite=lax", transaction.SetCookie[1]);
Assert.Equal("C=C; path=/; samesite=lax", transaction.SetCookie[2]);
Assert.Equal("D=D; path=/; samesite=lax; httponly", transaction.SetCookie[3]);
}));
}
@ -242,10 +242,10 @@ namespace Microsoft.AspNetCore.CookiePolicy.Test
var transaction = await server.SendAsync("http://example.com/login");
Assert.NotNull(transaction.SetCookie);
Assert.Equal("Hao=Hao; path=/; samesite=strict", transaction.SetCookie[0]);
Assert.Equal("Hao=Hao; path=/; samesite=strict", transaction.SetCookie[1]);
Assert.Equal("Hao=Hao; path=/; samesite=strict", transaction.SetCookie[2]);
Assert.Equal("Hao=Hao; path=/; secure; samesite=strict", transaction.SetCookie[3]);
Assert.Equal("Hao=Hao; path=/; samesite=lax", transaction.SetCookie[0]);
Assert.Equal("Hao=Hao; path=/; samesite=lax", transaction.SetCookie[1]);
Assert.Equal("Hao=Hao; path=/; samesite=lax", transaction.SetCookie[2]);
Assert.Equal("Hao=Hao; path=/; secure; samesite=lax", transaction.SetCookie[3]);
}
[Fact]