huahaofeng
/
aspnetcore
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Ignore null ExpiresUtc property in RequestRefresh 

Issue: https://github.com/aspnet/Security/issues/949
This commit is contained in:
Troy Dai 2016-08-26 11:46:29 -07:00
parent 3a5df89f1c
commit cbbec15d37
2 changed files with 56 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/Microsoft.AspNetCore.Authentication.Cookies/CookieAuthenticationHandler.cs
View File

@ -57,11 +57,17 @@ namespace Microsoft.AspNetCore.Authentication.Cookies
private void RequestRefresh(AuthenticationTicket ticket)
{
_shouldRefresh = true;
var currentUtc = Options.SystemClock.UtcNow;
_refreshIssuedUtc = currentUtc;
var timeSpan = ticket.Properties.ExpiresUtc.Value.Subtract(ticket.Properties.IssuedUtc.Value);
_refreshExpiresUtc = currentUtc.Add(timeSpan);
var issuedUtc = ticket.Properties.IssuedUtc;
var expiresUtc = ticket.Properties.ExpiresUtc;
if (issuedUtc != null && expiresUtc != null)
{
_shouldRefresh = true;
var currentUtc = Options.SystemClock.UtcNow;
_refreshIssuedUtc = currentUtc;
var timeSpan = expiresUtc.Value.Subtract(issuedUtc.Value);
_refreshExpiresUtc = currentUtc.Add(timeSpan);
}
}
private async Task<AuthenticateResult> ReadCookieTicket()

45
test/Microsoft.AspNetCore.Authentication.Test/Cookies/CookieMiddlewareTests.cs
View File

@ -1214,6 +1214,51 @@ namespace Microsoft.AspNetCore.Authentication.Cookies
Assert.Equal("Alice", FindClaimValue(transaction2, ClaimTypes.Name));
}
// Issue: https://github.com/aspnet/Security/issues/949
[Fact]
public async Task NullExpiresUtcPropertyIsGuarded()
{
var builder = new WebHostBuilder()
.ConfigureServices(services => services.AddAuthentication())
.Configure(app =>
{
app.UseCookieAuthentication(new CookieAuthenticationOptions
{
Events = new CookieAuthenticationEvents
{
OnValidatePrincipal = context =>
{
context.Properties.ExpiresUtc = null;
context.ShouldRenew = true;
return Task.FromResult(0);
}
}
});
app.Run(async context =>
{
if (context.Request.Path == "/signin")
{
await context.Authentication.SignInAsync(
CookieAuthenticationDefaults.AuthenticationScheme,
new ClaimsPrincipal(new ClaimsIdentity(new GenericIdentity("Alice", "Cookies"))));
}
else
{
await context.Response.WriteAsync("ha+1");
}
});
});
var server = new TestServer(builder);
var cookie = (await server.SendAsync("http://www.example.com/signin")).SetCookie.FirstOrDefault();
Assert.NotNull(cookie);
var transaction = await server.SendAsync("http://www.example.com/", cookie);
Assert.Equal(HttpStatusCode.OK, transaction.Response.StatusCode);
}
private class NoOpDataProtector : IDataProtector
{
public IDataProtector CreateProtector(string purpose)