Commit Graph

266 Commits

Author SHA1 Message Date
Hao Kung 663895377e
[release/5.0] Update cert that became valid and broke tests
- backport of 2e20babb19f0 (#32812)
- dupe of #33033

* Update cert to not be valid for 50 years

* Make cert valid in 10 years

* Delete unused copy of certs, update right one

* Skip test for now
2021-06-01 13:23:57 -07:00
William Godbe 028ea74958
[release/5.0] Resolve credscan bugs (#32656)
* Resolve conflicts

* Resolve remaining credscan bugs (#31157)

* Resolve final credscan bug (#31196)

Co-authored-by: Kevin Pilch <kevinpi@microsoft.com>
2021-05-20 10:35:01 -07:00
Doug Bunting 415875625c
[release/5.0] Update API baseline files (#27653)
* Move all PublicAPI.Unshipped.txt files to PublicAPI.Shipped.txt
- we have now shipped this API surface

* Add eng/PublicAPI.empty.txt file
- make it easier to add new implementation projects

* Add missing public API baseline files
- #26784 part 1/2
- a few unexpected files turned up missing beyond the #26784 list&hellip;

* Reference Microsoft.CodeAnalysis.PublicApiAnalyzers more often
- #27484 part 2/2
- emit errors when API baseline files are missing
- update categorization of some projects
  - specification tests are not implementation projects
    - but _were_ project reference providers (keep that)
  - correct `$(IsTestAssetProject)` setting for Razor shims et cetera
  - correct `$(IsSampleProject)` setting for casing of some Sample directories
  - Microsoft.AspNetCore.Analyzer.Testing should be treated as test asset
- add `$(AddPublicApiAnalyzers)` property to support overrides
  - e.g. for `msbuild` task projects and tools

nit:
- remove useless `$(IsTestProject)` setting in a specification test project
- wrap some long `Condition`s

* Do not run public API analyzer in `RazorCoreCompile` target

* Remove old `$(EnableApiCheck)` settings
- property does nothing
- also remove a dangling ApiCheck comment
2020-11-12 10:28:52 -08:00
Pranav K fae3437139
Add docs for remaining security items (#26827)
* Add docs for remaining security items

* Google / Facebook / Microsoft Account auth
* Authorization, Authorization.Policy

Contributes to https://github.com/dotnet/aspnetcore/issues/26397

* Apply suggestions from code review

Co-authored-by: Chris Ross <Tratcher@Outlook.com>

* Update src/Security/Authorization/Policy/src/AuthorizationMiddleware.cs

Co-authored-by: Chris Ross <Tratcher@Outlook.com>
2020-10-14 15:36:26 -07:00
Doug Bunting 8399c9f3f9
!!! Correct condition controlling `public` API analysis !!! (#26797)
* !!! Correct condition controlling `public` API analysis !!!
-  #26785 demonstrated analyzers were inoperable

* Remove unused `public` API files

* Update `public` API files
- three Components files were missing `#nullable enable`
- `nullable` annotations missing or out-of-date elsewhere

* Ignore `public` API files completely during source build
- do not warn about unused files

* Update more `public` API files
2020-10-12 11:07:18 -07:00
Pranav K 8b741bd9c6
Add docs for Negotiate, OAuth, OpenIdConnect (#26610)
* Add docs for Negotiate, OAuth, OpenIdConnect

Contributes to #26397
2020-10-06 08:41:47 -07:00
Stephen Halter 96c082f285
Fix WebSockets Negotiate Auth in Kestrel (#26480)
* Don't close connections after upgrade requests without a 101 response

* Add test

* Add DefautCredentials_WebSocket_Success
2020-10-02 14:47:20 -07:00
Pranav K e755f6017c
Add docs for Auth, Auth.Cookies, Auth.Certificate (#26503)
* Add docs for Auth, Auth.Cookies, Auth.Certificate

Contributes to https://github.com/dotnet/aspnetcore/issues/26397

* Also add JWT

* Apply suggestions from code review

Co-authored-by: Hao Kung <HaoK@users.noreply.github.com>
Co-authored-by: Chris Ross <Tratcher@Outlook.com>

* Update src/Security/Authentication/Core/src/TicketSerializer.cs

* Update src/Security/Authentication/Core/src/TicketSerializer.cs

* Update src/Security/Authentication/Core/src/TicketSerializer.cs

* Apply suggestions from code review

Co-authored-by: Hao Kung <HaoK@users.noreply.github.com>
Co-authored-by: Chris Ross <Tratcher@Outlook.com>
2020-10-02 13:12:16 -07:00
Pranav K a218c3bea6
Add docs to CookiePolicy (#26446)
* Add docs to CookiePolicy

Contributes to https://github.com/dotnet/aspnetcore/issues/26397

* Apply suggestions from code review
2020-09-30 13:45:18 -07:00
Pranav K 690c717314
Update to latest SDK (#25421)
* React to platform compatibility analyzer warnings
* React to new warnings
* Add platform compatibility attributes
2020-09-10 15:12:17 -07:00
Kevin Pilch 14a3862f5f
Add Public API baselines for Security (#25651) 2020-09-09 21:07:15 -07:00
John Luo 035221d731
Add cache for retrieved RBAC claims (#25698) 2020-09-09 14:24:48 -07:00
John Luo c902645115
Add MigrationsEndPoint when DatabaseDeveloperPageExceptionFilter is used (#25554) 2020-09-04 15:46:14 -07:00
Artak 0ebd5f040b
Merge pull request #25277 from dotnet/prkrishn/nullability-feedback
Address nullability feedback
2020-08-28 15:30:22 -07:00
Kevin Pilch 748b368d54
Handle auth schemes in cookie names (#25279)
* Handle auth schemes in cookie names #25266

* With unicode
2020-08-28 09:00:36 -07:00
William Godbe ce058f639c
Add net461 TFM to netstandard2.0 projects (#25094)
* Add net461 TFM to netstandard2.0 projects

* Fix a couple of errors

* Fix some errors

* Get rid of Sockets reference

* Respond to feedback

* net461 -> property

* Fixup clientSample

* Remove net461 from analyzers/razor

* Remove net461 from test projects

* Feedback

* Add net461 test configs

* Remove some incompatible test configs

* Fix test
2020-08-27 16:05:40 -07:00
Pranav K 87a51a358a
Merge branch 'release/5.0' into prkrishn/nullability-feedback 2020-08-26 16:38:48 -07:00
Chris R f33937f04d With unicode 2020-08-26 12:04:14 -07:00
Chris R 4636950bfa Handle auth schemes in cookie names #25266 2020-08-26 11:32:05 -07:00
Pranav K 00bbb78d3c
Address nullability feedback
Fixes https://github.com/dotnet/aspnetcore/issues/25275
2020-08-26 09:55:27 -07:00
John Luo 098be5f5ee
Use LDAP support from DirectoryServices.Protocols for RBAC claim resolution on Linux for Negotiate (#25075) 2020-08-25 13:21:46 -07:00
Chris Ross e5ab127f74
Update OAuth providers #4684 (#25112) 2020-08-23 17:04:43 -07:00
Martin Costello b22512de0e
Right-size Lists when created (#23714)
Create new instances of List<T> with an appropriate capacity for the items that will be added.
Use Array.Empty<T>() where appropriate, rather than create an empty list and then return it.
2020-08-19 09:45:52 -07:00
John Luo cfe158cbed
Convert DatabaseErrorPage to exception filter (#24588)
* Convert DatabaseErrorPage middleware to exception filter
2020-08-17 11:13:17 -07:00
John Luo eb1d6aec16
Update exception handling condition in WsFederationHandler (#24886)
Fixes
2020-08-13 22:48:04 +00:00
Hao Kung fae4a56ff6
Add MapInboundClaims top level sugar for JwtBearerOptions (#24636)
* Add MapInboundClaims option

* Update JwtBearerOptions.cs

* Update JwtBearerTests.cs

* Update JwtBearerOptions.cs

* Update JwtBearerOptions.cs

* Update JwtBearerTests.cs

* Add MapImboundClaims to OIDC

* Update OpenIdConnectTests.cs

* Update OpenIdConnectOptions.cs

* Update OpenIdConnectOptions.cs

* Use MapInboundClaims

* Update OpenIdConnectTests.cs
2020-08-13 22:44:10 +00:00
Levi Broderick bbf7c8780c
Clean up some usage of SHA1 and SHA256 in the code base (#24696)
* AntiForgery: Use SHA256 one-shot

* AuthN: Use SHA256 one-shot APIs

* MVC/Razor: Cleanup SHA256 references

* WebSockets: Use SHA1 one-shots

* dotnet-openapi: Use preferred SHA256 factory

* SignalR: Prefer RNG.Fill over RNG.GetBytes
2020-08-10 14:26:41 -07:00
David Fowler 0e592df3ec
Make authentication linker friendly (#24708)
* Make authentication linker friendly
- Preserve constructors wherever open generics or type arguments exist
2020-08-10 13:06:19 -07:00
Pranav K 3e1e69ecce
Add nullable annotations to Authenticator.Core & Authentication.Cookies (#24307)
Contributes to https://github.com/dotnet/aspnetcore/issues/5680
2020-07-30 17:09:14 -07:00
Kahbazi 6097145096
[Security] Move to GenericHost (#24282) 2020-07-27 13:09:15 -07:00
Hao Kung 697b397b9b
Revert AuthenticationAddXyz overload changes (#24253) 2020-07-23 15:00:01 -07:00
Doug Bunting 5266918ed2
Use Roslyn to create ref/ assemblies (#23403)
* Remove all ref/ projects

* Remove GenAPI infrastructure

* Remove notion of a reference assembly project
  - remove `$(IsReferenceAssemblyProject)`, `$(ReferenceReferenceAssemblies)` and `$(ReferenceImplementationAssemblies)`
    - remove unnecessary `$(NoWarn)` settings

nits:
- remove a few misleading comments
- wrap some long lines

* Move .0 package version workaround into Versions.props
  - touch up SharedFramework.External.props

* Expose `%(LatestPackageReference.RTMVersion)` metadata
  - automate use of properties in the `@(LatestPackageReference)` item group to make this maintainable
    - add a couple of special cases at the bottom of eng/Dependencies.props
    - add one more `$(...PackageVersion)` property to avoid yet-another special case

* Enable Roslyn reference assemblies
  - exclude ref/ assembly from packages other than targeting pack
  - update Microsoft.AspNetCore.App.Ref.csproj
    - `%(IsReferenceAssembly)` and `%(ReferenceGrouping)` metadata no longer relevant
    - only ref/ assemblies are in `@(ReferencePathWithRefAssemblies)` item group

nits:
  - remove now-unnecessary workaround
    - issues with TFM transition are behind us
  - clean up Microsoft.AspNetCore.App.Runtime.csproj slightly
    - use `GeneratePathProperty="true"`
        - reorder item / property settings for meta-expansion
    - correct spelling errors and phrasing in comments

* Update documentation to reflect recent changes
  - remove CrossRepoBreakingChanges.md; was tied to old TeamCity infrastructure
    - also much less relevant given repo merges
  - adjust details and examples in ReferenceResolution.md
    - reflect repo merges, Dependencies.props changes, and current Maestro++ channels
    - add a few more details e.g. specific files where Version.Details.xml versions are used

* !fixup! Remove another irrelevant doc file

* !fixup! Address PR review suggestions
  - convert a couple of warnings to errors
  - use consistent casing for Microsoft.NETCore.App.Runtime.* packages
  - reduce `%(LatestPackageReference.Version)` metadata special cases
  - add and improve comments e.g.
    - improve comments about `$(*V0PackageVersion)` properties
    - improve placement of comments about item removal in ResolveReferences.targets
    - confirmed `$(*V0PackageVersion)` property list is complete

nits:
- fix solution example in ReferenceResolution.md
- remove item group definition for `@(LatestPackageReference)`
- remove `%(LatestPackageReference.VersionName)` metadata after use; large item group
    - similarly, remove `%(LatestPackageReference.RTMVersion)` when not needed; just complicates `Condition`s

When I squash, I must remember this fixes
- #14801
- dotnet/aspnetcore-internal#2693

* Actually use `%(LatestPackageReference.RTMVersion)` metadata
  - gather RTM package references in a new project
    - a (very) separate project to work around package conflict resolution
    - empty `Test` target works around Arcade's testing approach
  - new target in ResolveReferences.targets updates relevant assembly paths to use the RTM packages
    - done as soon as possible after `ResolvePackageAssets` determines the paths
    - done for all compilation inputs, not just ref/ assemblies
2020-07-17 13:35:17 -07:00
Hao Kung fae3dd12ae
Switch to new host apis (#23783)
* Update tests

* Switch to new host apis

* Update host apis

* Update CookieTests.cs

* Update tests

* PR feedback/cleanup

* More cleanup
2020-07-11 00:56:18 +00:00
Kevin Pilch 3117f43c33
Migrate to single sln file + slnf files (#23581) 2020-07-08 15:27:22 -07:00
Pranav K 93634cd772
Follow ups for nullable (#23736)
* Follow ups for nullable

* Update src/Http/Routing/src/Matching/DfaMatcherBuilder.cs

Co-authored-by: James Newton-King <james@newtonking.com>

Co-authored-by: James Newton-King <james@newtonking.com>
2020-07-07 21:46:50 +00:00
Kahbazi 5a375a7c22
Add Extensions method for options (#23602) 2020-07-06 11:54:44 -07:00
Pranav K 9a4e6cf97c
Merge remote-tracking branch 'origin/release/5.0-preview7' 2020-07-02 11:42:14 -07:00
Hans Bakker 5db89514e8
Allow extensibility of DefaultAuthorizationService (#23143)
* Allow extensibility of DefaultAuthorizationService

When only a small behavior change of the `DefaultAuthorizationService` is wanted, it would be nice if you could override its methods and building upon them rather than having a copy-paste of the class in your codebase.

Inside the `override` methods in your inherited class you could call the `base` method to reuse parts of its logic.

Please refer to https://github.com/dotnet/aspnetcore/issues/23094 for the usecase.

* updated ref assembly
2020-06-30 17:06:00 -07:00
Ajay Bhargav B 7f4b846e9f
Made the encodings of .razor and .cshtml files in the repo consistent (#23502)
* Added UTF8 BOMs to .razor and .cshtml files

* Fixes and unquarantined BOM tests

* Update .editorconfig
2020-06-30 12:03:01 -07:00
Hao Kung 1c27ba1bbd
Add compat switch to opt out of breaking change in AuthZ (#23324) 2020-06-29 21:50:27 -07:00
Hao Kung be0b9e48b5
Update System.IdentityModel.Tokens.Jwt to 6.6 (#22846)
* Update System.IdentityModel.Tokens.Jwt to 6.6

* Update Versions.props

* Add newtonsoft refs

* Update OIDC instructions

* Fixup JwtBearerSample TFM

Co-authored-by: John Luo <johluo@microsoft.com>
2020-06-25 14:25:59 -07:00
Hao Kung 8541bf6c98
Flow endpoint and httpcontext always from authz middleware (#22672) 2020-06-19 18:14:47 -07:00
Pranav K f3b370c1ac
Annotate Authorization.Core, Authorization.Policy with nullable (#22990)
Contributes to https://github.com/dotnet/aspnetcore/issues/5680
2020-06-18 23:43:35 +00:00
Doug Bunting c4c6e25a06
Add missing doc files and cleanup nits (#22931)
* nit: Remove useless `$(HasReferenceAssembly)` settings
  - set in /Directory.Build.targets
    - `true` only in `$(IsAspNetCoreApp)` projects
* nit: Remove useless `$(CompileUsingReferenceAssemblies)` settings
  - no current versioning differences between ref/ and src/ assemblies when targeting default TFM
* Add more `$(GenerateDocumentationFile)` settings
  - increases the number of generated doc files, mostly without problems
- !fixup! correct typo in `DebugProxyHost` doc comments
    - was not generating a doc file before
  - remove previous (ineffective) src/Components/Directory.Build.targets setting
  - nit: remove a duplicate `$(GenerateDocumentationFile)` setting
* nit: Remove useless `$(IsPackable)` settings
  - only analyzers and implementation projects are packable by default
    - main use case for explicit setting is projects shipping only in shared framework
  - conditional setting in src/Mvc/Directory.Build.props just subset logic in /Directory.Build.targets
* nit: Remove useless `$(IsProjectReferenceProvider)` settings
  - only implementation projects are providers by default
* nit: Remove useless `$(IsTestAssetProject)` settings
  - set in src/Mvc/test/WebSites/Directory.Build.props
* !fixup! Looks like `InProcessNewShimWebSite` must compile w/o ref/ assemblies
  - restore `$(CompileUsingReferenceAssemblies)` in this one project
2020-06-17 13:04:45 -07:00
Hao Kung c330c0b37d
Cookie renew ticket if it already exists (#22732) 2020-06-16 14:51:57 -07:00
Hao Kung ef5ab43b6f
Use redirect helper (#22847) 2020-06-15 11:34:56 -07:00
John Luo ef9a3662d6
Also set no-store when we set no-cache in response cache control headers (#22842) 2020-06-11 20:38:54 -07:00
Smit Patel 3cdc7164e7 Add pragma disable to older migration files
Resolves #22630
2020-06-07 11:17:45 -07:00
Smit Patel a963bbebf9 Add obsolete disable in older model snapshot
Revert to using older API

Resolves #22610
2020-06-06 12:01:31 -07:00
Hao Kung 8e4dadc0dd
Add certificate validation cache (#21847) 2020-06-05 00:58:47 -07:00