Commit Graph

156 Commits

Author SHA1 Message Date
Hao Kung 663895377e
[release/5.0] Update cert that became valid and broke tests
- backport of 2e20babb19f0 (#32812)
- dupe of #33033

* Update cert to not be valid for 50 years

* Make cert valid in 10 years

* Delete unused copy of certs, update right one

* Skip test for now
2021-06-01 13:23:57 -07:00
William Godbe 028ea74958
[release/5.0] Resolve credscan bugs (#32656)
* Resolve conflicts

* Resolve remaining credscan bugs (#31157)

* Resolve final credscan bug (#31196)

Co-authored-by: Kevin Pilch <kevinpi@microsoft.com>
2021-05-20 10:35:01 -07:00
Doug Bunting 415875625c
[release/5.0] Update API baseline files (#27653)
* Move all PublicAPI.Unshipped.txt files to PublicAPI.Shipped.txt
- we have now shipped this API surface

* Add eng/PublicAPI.empty.txt file
- make it easier to add new implementation projects

* Add missing public API baseline files
- #26784 part 1/2
- a few unexpected files turned up missing beyond the #26784 list&hellip;

* Reference Microsoft.CodeAnalysis.PublicApiAnalyzers more often
- #27484 part 2/2
- emit errors when API baseline files are missing
- update categorization of some projects
  - specification tests are not implementation projects
    - but _were_ project reference providers (keep that)
  - correct `$(IsTestAssetProject)` setting for Razor shims et cetera
  - correct `$(IsSampleProject)` setting for casing of some Sample directories
  - Microsoft.AspNetCore.Analyzer.Testing should be treated as test asset
- add `$(AddPublicApiAnalyzers)` property to support overrides
  - e.g. for `msbuild` task projects and tools

nit:
- remove useless `$(IsTestProject)` setting in a specification test project
- wrap some long `Condition`s

* Do not run public API analyzer in `RazorCoreCompile` target

* Remove old `$(EnableApiCheck)` settings
- property does nothing
- also remove a dangling ApiCheck comment
2020-11-12 10:28:52 -08:00
Pranav K fae3437139
Add docs for remaining security items (#26827)
* Add docs for remaining security items

* Google / Facebook / Microsoft Account auth
* Authorization, Authorization.Policy

Contributes to https://github.com/dotnet/aspnetcore/issues/26397

* Apply suggestions from code review

Co-authored-by: Chris Ross <Tratcher@Outlook.com>

* Update src/Security/Authorization/Policy/src/AuthorizationMiddleware.cs

Co-authored-by: Chris Ross <Tratcher@Outlook.com>
2020-10-14 15:36:26 -07:00
Doug Bunting 8399c9f3f9
!!! Correct condition controlling `public` API analysis !!! (#26797)
* !!! Correct condition controlling `public` API analysis !!!
-  #26785 demonstrated analyzers were inoperable

* Remove unused `public` API files

* Update `public` API files
- three Components files were missing `#nullable enable`
- `nullable` annotations missing or out-of-date elsewhere

* Ignore `public` API files completely during source build
- do not warn about unused files

* Update more `public` API files
2020-10-12 11:07:18 -07:00
Pranav K 8b741bd9c6
Add docs for Negotiate, OAuth, OpenIdConnect (#26610)
* Add docs for Negotiate, OAuth, OpenIdConnect

Contributes to #26397
2020-10-06 08:41:47 -07:00
Stephen Halter 96c082f285
Fix WebSockets Negotiate Auth in Kestrel (#26480)
* Don't close connections after upgrade requests without a 101 response

* Add test

* Add DefautCredentials_WebSocket_Success
2020-10-02 14:47:20 -07:00
Pranav K e755f6017c
Add docs for Auth, Auth.Cookies, Auth.Certificate (#26503)
* Add docs for Auth, Auth.Cookies, Auth.Certificate

Contributes to https://github.com/dotnet/aspnetcore/issues/26397

* Also add JWT

* Apply suggestions from code review

Co-authored-by: Hao Kung <HaoK@users.noreply.github.com>
Co-authored-by: Chris Ross <Tratcher@Outlook.com>

* Update src/Security/Authentication/Core/src/TicketSerializer.cs

* Update src/Security/Authentication/Core/src/TicketSerializer.cs

* Update src/Security/Authentication/Core/src/TicketSerializer.cs

* Apply suggestions from code review

Co-authored-by: Hao Kung <HaoK@users.noreply.github.com>
Co-authored-by: Chris Ross <Tratcher@Outlook.com>
2020-10-02 13:12:16 -07:00
Pranav K 690c717314
Update to latest SDK (#25421)
* React to platform compatibility analyzer warnings
* React to new warnings
* Add platform compatibility attributes
2020-09-10 15:12:17 -07:00
Kevin Pilch 14a3862f5f
Add Public API baselines for Security (#25651) 2020-09-09 21:07:15 -07:00
John Luo 035221d731
Add cache for retrieved RBAC claims (#25698) 2020-09-09 14:24:48 -07:00
Artak 0ebd5f040b
Merge pull request #25277 from dotnet/prkrishn/nullability-feedback
Address nullability feedback
2020-08-28 15:30:22 -07:00
Pranav K 87a51a358a
Merge branch 'release/5.0' into prkrishn/nullability-feedback 2020-08-26 16:38:48 -07:00
Chris R f33937f04d With unicode 2020-08-26 12:04:14 -07:00
Chris R 4636950bfa Handle auth schemes in cookie names #25266 2020-08-26 11:32:05 -07:00
Pranav K 00bbb78d3c
Address nullability feedback
Fixes https://github.com/dotnet/aspnetcore/issues/25275
2020-08-26 09:55:27 -07:00
John Luo 098be5f5ee
Use LDAP support from DirectoryServices.Protocols for RBAC claim resolution on Linux for Negotiate (#25075) 2020-08-25 13:21:46 -07:00
Chris Ross e5ab127f74
Update OAuth providers #4684 (#25112) 2020-08-23 17:04:43 -07:00
Martin Costello b22512de0e
Right-size Lists when created (#23714)
Create new instances of List<T> with an appropriate capacity for the items that will be added.
Use Array.Empty<T>() where appropriate, rather than create an empty list and then return it.
2020-08-19 09:45:52 -07:00
John Luo eb1d6aec16
Update exception handling condition in WsFederationHandler (#24886)
Fixes
2020-08-13 22:48:04 +00:00
Hao Kung fae4a56ff6
Add MapInboundClaims top level sugar for JwtBearerOptions (#24636)
* Add MapInboundClaims option

* Update JwtBearerOptions.cs

* Update JwtBearerTests.cs

* Update JwtBearerOptions.cs

* Update JwtBearerOptions.cs

* Update JwtBearerTests.cs

* Add MapImboundClaims to OIDC

* Update OpenIdConnectTests.cs

* Update OpenIdConnectOptions.cs

* Update OpenIdConnectOptions.cs

* Use MapInboundClaims

* Update OpenIdConnectTests.cs
2020-08-13 22:44:10 +00:00
Levi Broderick bbf7c8780c
Clean up some usage of SHA1 and SHA256 in the code base (#24696)
* AntiForgery: Use SHA256 one-shot

* AuthN: Use SHA256 one-shot APIs

* MVC/Razor: Cleanup SHA256 references

* WebSockets: Use SHA1 one-shots

* dotnet-openapi: Use preferred SHA256 factory

* SignalR: Prefer RNG.Fill over RNG.GetBytes
2020-08-10 14:26:41 -07:00
David Fowler 0e592df3ec
Make authentication linker friendly (#24708)
* Make authentication linker friendly
- Preserve constructors wherever open generics or type arguments exist
2020-08-10 13:06:19 -07:00
Pranav K 3e1e69ecce
Add nullable annotations to Authenticator.Core & Authentication.Cookies (#24307)
Contributes to https://github.com/dotnet/aspnetcore/issues/5680
2020-07-30 17:09:14 -07:00
Kahbazi 6097145096
[Security] Move to GenericHost (#24282) 2020-07-27 13:09:15 -07:00
Hao Kung 697b397b9b
Revert AuthenticationAddXyz overload changes (#24253) 2020-07-23 15:00:01 -07:00
Doug Bunting 5266918ed2
Use Roslyn to create ref/ assemblies (#23403)
* Remove all ref/ projects

* Remove GenAPI infrastructure

* Remove notion of a reference assembly project
  - remove `$(IsReferenceAssemblyProject)`, `$(ReferenceReferenceAssemblies)` and `$(ReferenceImplementationAssemblies)`
    - remove unnecessary `$(NoWarn)` settings

nits:
- remove a few misleading comments
- wrap some long lines

* Move .0 package version workaround into Versions.props
  - touch up SharedFramework.External.props

* Expose `%(LatestPackageReference.RTMVersion)` metadata
  - automate use of properties in the `@(LatestPackageReference)` item group to make this maintainable
    - add a couple of special cases at the bottom of eng/Dependencies.props
    - add one more `$(...PackageVersion)` property to avoid yet-another special case

* Enable Roslyn reference assemblies
  - exclude ref/ assembly from packages other than targeting pack
  - update Microsoft.AspNetCore.App.Ref.csproj
    - `%(IsReferenceAssembly)` and `%(ReferenceGrouping)` metadata no longer relevant
    - only ref/ assemblies are in `@(ReferencePathWithRefAssemblies)` item group

nits:
  - remove now-unnecessary workaround
    - issues with TFM transition are behind us
  - clean up Microsoft.AspNetCore.App.Runtime.csproj slightly
    - use `GeneratePathProperty="true"`
        - reorder item / property settings for meta-expansion
    - correct spelling errors and phrasing in comments

* Update documentation to reflect recent changes
  - remove CrossRepoBreakingChanges.md; was tied to old TeamCity infrastructure
    - also much less relevant given repo merges
  - adjust details and examples in ReferenceResolution.md
    - reflect repo merges, Dependencies.props changes, and current Maestro++ channels
    - add a few more details e.g. specific files where Version.Details.xml versions are used

* !fixup! Remove another irrelevant doc file

* !fixup! Address PR review suggestions
  - convert a couple of warnings to errors
  - use consistent casing for Microsoft.NETCore.App.Runtime.* packages
  - reduce `%(LatestPackageReference.Version)` metadata special cases
  - add and improve comments e.g.
    - improve comments about `$(*V0PackageVersion)` properties
    - improve placement of comments about item removal in ResolveReferences.targets
    - confirmed `$(*V0PackageVersion)` property list is complete

nits:
- fix solution example in ReferenceResolution.md
- remove item group definition for `@(LatestPackageReference)`
- remove `%(LatestPackageReference.VersionName)` metadata after use; large item group
    - similarly, remove `%(LatestPackageReference.RTMVersion)` when not needed; just complicates `Condition`s

When I squash, I must remember this fixes
- #14801
- dotnet/aspnetcore-internal#2693

* Actually use `%(LatestPackageReference.RTMVersion)` metadata
  - gather RTM package references in a new project
    - a (very) separate project to work around package conflict resolution
    - empty `Test` target works around Arcade's testing approach
  - new target in ResolveReferences.targets updates relevant assembly paths to use the RTM packages
    - done as soon as possible after `ResolvePackageAssets` determines the paths
    - done for all compilation inputs, not just ref/ assemblies
2020-07-17 13:35:17 -07:00
Hao Kung fae3dd12ae
Switch to new host apis (#23783)
* Update tests

* Switch to new host apis

* Update host apis

* Update CookieTests.cs

* Update tests

* PR feedback/cleanup

* More cleanup
2020-07-11 00:56:18 +00:00
Hao Kung be0b9e48b5
Update System.IdentityModel.Tokens.Jwt to 6.6 (#22846)
* Update System.IdentityModel.Tokens.Jwt to 6.6

* Update Versions.props

* Add newtonsoft refs

* Update OIDC instructions

* Fixup JwtBearerSample TFM

Co-authored-by: John Luo <johluo@microsoft.com>
2020-06-25 14:25:59 -07:00
Doug Bunting c4c6e25a06
Add missing doc files and cleanup nits (#22931)
* nit: Remove useless `$(HasReferenceAssembly)` settings
  - set in /Directory.Build.targets
    - `true` only in `$(IsAspNetCoreApp)` projects
* nit: Remove useless `$(CompileUsingReferenceAssemblies)` settings
  - no current versioning differences between ref/ and src/ assemblies when targeting default TFM
* Add more `$(GenerateDocumentationFile)` settings
  - increases the number of generated doc files, mostly without problems
- !fixup! correct typo in `DebugProxyHost` doc comments
    - was not generating a doc file before
  - remove previous (ineffective) src/Components/Directory.Build.targets setting
  - nit: remove a duplicate `$(GenerateDocumentationFile)` setting
* nit: Remove useless `$(IsPackable)` settings
  - only analyzers and implementation projects are packable by default
    - main use case for explicit setting is projects shipping only in shared framework
  - conditional setting in src/Mvc/Directory.Build.props just subset logic in /Directory.Build.targets
* nit: Remove useless `$(IsProjectReferenceProvider)` settings
  - only implementation projects are providers by default
* nit: Remove useless `$(IsTestAssetProject)` settings
  - set in src/Mvc/test/WebSites/Directory.Build.props
* !fixup! Looks like `InProcessNewShimWebSite` must compile w/o ref/ assemblies
  - restore `$(CompileUsingReferenceAssemblies)` in this one project
2020-06-17 13:04:45 -07:00
Hao Kung c330c0b37d
Cookie renew ticket if it already exists (#22732) 2020-06-16 14:51:57 -07:00
Hao Kung ef5ab43b6f
Use redirect helper (#22847) 2020-06-15 11:34:56 -07:00
John Luo ef9a3662d6
Also set no-store when we set no-cache in response cache control headers (#22842) 2020-06-11 20:38:54 -07:00
Hao Kung 8e4dadc0dd
Add certificate validation cache (#21847) 2020-06-05 00:58:47 -07:00
Chris Ross 2bf3960dea
Optional client certificates sample (#21484)
* Add an optional client certs example

* Add the Challenge event

* PR cleanup
2020-06-05 01:34:21 +00:00
Doug Bunting 256045729a
Add `SuccessfulTests` to ensure something runs in every non-Helix run (#22406)
* Remove extra `[SkipOnHelix]` attribute
- only need the one compiled into Microsoft.AspNetCore.Testing
- update the documentation to reflect this
  - nit: address Markdown warnings that VS Code showed

* Add `SuccessfulTests` to ensure something runs in every non-Helix runs
- #22241
- cleans up hundreds of warnings but leaves a couple for the Blazor tests assembly
  - see comments about xUnit runner command line in the new class
2020-06-02 12:19:28 -07:00
Giuseppe Campanelli 78edd18524
Clean up logs for Negotiate Authentication and Authorization (#21927)
* Clean up logs for Negotiate Authentication and Authorization

* Add missing arg in NegotiateLoggingExtensions.cs

* Adjust formatting

* Remaining text changes

* Update src/Security/Authentication/Negotiate/src/Internal/NegotiateLoggingExtensions.cs

Co-authored-by: Chris Ross <Tratcher@Outlook.com>

* Update src/Security/Authentication/Negotiate/src/Internal/NegotiateLoggingExtensions.cs

Co-authored-by: Chris Ross <Tratcher@Outlook.com>

* Update src/Security/Authentication/Negotiate/src/NegotiateHandler.cs

Co-authored-by: Chris Ross <Tratcher@Outlook.com>

* Update src/Security/Authentication/Negotiate/src/Internal/NegotiateLoggingExtensions.cs

Co-authored-by: Chris Ross <Tratcher@Outlook.com>

* Apply changes to feedback committed

* Update logger call to refactored name

Co-authored-by: Chris Ross <Tratcher@Outlook.com>
Co-authored-by: Giuseppe Campanelli <campanelli_g@yahoo.com>
2020-05-19 15:59:29 +00:00
Justin Kotalik 41eb22a0ac
Unquarantine tests (#21895)
* Unquarantine tests

* Update ShutdownTests.cs

* Update ShutdownTests.cs

* Update HubConnectionHandlerTests.cs

* Update src/SignalR/server/SignalR/test/HubConnectionHandlerTests.cs

Co-authored-by: Brennan <brecon@microsoft.com>

* Update HubConnectionTests.cs

Co-authored-by: Sébastien Ros <sebastienros@gmail.com>
Co-authored-by: Brennan <brecon@microsoft.com>
2020-05-18 19:04:48 +00:00
John Luo 84a04c9df1
Quarantining tests (#20631)
* Quarantining tests

* Namespace collision
2020-04-08 12:53:53 -07:00
Kahbazi 1f76cce14a
Add overloads to CookieAuthentication to config options with services (#19268)
* Add overloads to CookieAuthentication to config options with services

* Update reference assembly

* Use the new method in sampple

* Add overloads for other authentication providers

* Update ref assemblies

* Change IServiceProvider to TService
2020-04-06 21:23:49 +00:00
Andrew Stanton-Nurse 3f683916bc
unquarantine negotiate tests (#20378)
these were quarantined because of the runtime JIT bug that caused DI failures, they can come out of the box now that the runtime issue is fixed
2020-03-31 23:56:45 +00:00
huysentruitw 16e2586724
Use Backchannel.DefaultRequestVersion in OAuth & OIDC requests #20096 (#20295) 2020-03-30 20:12:54 +00:00
Roman Marusyk 28de202a3b
Use the custom token endpoint if it's available in OIDC Handler (#20230) 2020-03-30 19:52:33 +00:00
Patrick Goode ae192af856
Make change for #18729 (#19756) 2020-03-17 22:22:28 +00:00
Andrew Stanton-Nurse 3b4be4f51a
Quarantining some tests (#19568) 2020-03-04 11:27:55 -08:00
Sedat Kapanoglu 7e139c9b5f
Add HeaderNames.XRequestedWith = "X-Requested-With" (#19470)
* Add HeaderNames.XRequestedWith = "X-Requested-With"

X-Requested-With is the standard for differentiating AJAX requests and is commonly used. Having this in HeaderNames would prevent typos related to typing this header name. I couldn't find any rationale about excluding this but there might be legitimate reasons like discouraging the use of HTTP headers or differentiating AJAX requests, etc. Please reject this if that's the case.

* Replace "X-Requested-With" references with HeaderNames.XRequestedWith

The only remaining instance is WebSocketsTransport.cs in
SignalR\clients\csharp\Http.Connections.Client which doesn't have
Microsoft.Net in its references. I didn't want to impose a new
dependency as its risky.

* Fix the order of using statements

* Add XRequestedWith to the ref assembly
2020-03-03 15:45:50 -08:00
Brennan Conroy 2d066dcd3e Apply some fixes 2020-02-19 14:18:29 -08:00
Stephen Halter 88073f86ff Merge branch 'release/3.1' into master 2020-02-18 13:46:51 -08:00
Chris Ross 7e094d7b7d
Update OIDC SameSite sample (#18934) 2020-02-14 18:07:46 +00:00
Doug Bunting a6c43b14a1
Mark AspNetCore projects that aren't packaged explicitly (#18767)
* Mark AspNetCore projects that aren't packaged explicitly
- avoid NU5104 warnings due to confusing versioning
- `$(IsShippingPackage)` was semantically incorrect in any case

* Remove redundant `$(IsShippingPackage)` settings in `$(IsAspNetCoreApp)` projects
- default is `true` for all implementation projects

* Use `$(IsPackable)` when deciding how `$(IsAspNetCoreApp)` projects are handled
- remove all use of `$(IsShippingPackage)` for shared framework composition
- update documentation to match these changes

nits:
- remove odd default for `$(IsPackable)` in Directory.Build.targets
  - no longer relevant since all `$(IsAspNetCoreApp)` projects are `$(IsShippingPackage)` too
- include more information in docs/ProjectProperties.md

* Add direct System.Text.Json references
- avoid MSB3277 warnings
2020-02-13 15:51:27 -08:00