#808 Add Cors feature

Orchard.sln

@@ -1,7 +1,7 @@
 
 Microsoft Visual Studio Solution File, Format Version 12.00
 # Visual Studio 15
-VisualStudioVersion = 15.0.26606.0
+VisualStudioVersion = 15.0.26430.12
 MinimumVisualStudioVersion = 10.0.40219.1
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "OrchardCore.Modules.Cms", "OrchardCore.Modules.Cms", "{90030E85-0C4F-456F-B879-443E8A3F220D}"
 EndProject
@@ -249,19 +249,19 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Aspects", "Aspects", "{3398
 EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Orchard.Tokens.Content.Abstractions", "src\OrchardCore\Orchard.Tokens.Content.Abstractions\Orchard.Tokens.Content.Abstractions.csproj", "{677113F9-C548-4EB8-B248-E03BF967FA22}"
 EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Orchard.Logging.NLog", "src\OrchardCore\Orchard.Logging.NLog\Orchard.Logging.NLog.csproj", "{00677E44-3048-4BAA-8F97-B577CC0EB788}"
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Orchard.Logging.NLog", "src\OrchardCore\Orchard.Logging.NLog\Orchard.Logging.NLog.csproj", "{00677E44-3048-4BAA-8F97-B577CC0EB788}"
 EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Orchard.Queries", "src\OrchardCore.Modules\Orchard.Queries\Orchard.Queries.csproj", "{4FC00B36-DF0A-400F-8E1A-E700B5D58F98}"
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Orchard.Queries", "src\OrchardCore.Modules\Orchard.Queries\Orchard.Queries.csproj", "{4FC00B36-DF0A-400F-8E1A-E700B5D58F98}"
 EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Orchard.Liquid.Abstractions", "src\OrchardCore\Orchard.Liquid.Abstractions\Orchard.Liquid.Abstractions.csproj", "{2DF44392-8882-46B1-8061-61DDBCA358BD}"
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Orchard.Liquid.Abstractions", "src\OrchardCore\Orchard.Liquid.Abstractions\Orchard.Liquid.Abstractions.csproj", "{2DF44392-8882-46B1-8061-61DDBCA358BD}"
 EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Orchard.Lucene.Abstractions", "src\OrchardCore\Orchard.Lucene.Abstractions\Orchard.Lucene.Abstractions.csproj", "{78F13261-B843-4590-8DD5-E9491874D0CD}"
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Orchard.Lucene.Abstractions", "src\OrchardCore\Orchard.Lucene.Abstractions\Orchard.Lucene.Abstractions.csproj", "{78F13261-B843-4590-8DD5-E9491874D0CD}"
 EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Orchard.Liquid", "src\OrchardCore.Modules\Orchard.Liquid\Orchard.Liquid.csproj", "{F8973BF9-4F56-4A59-9153-72BEDB6AB269}"
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Orchard.Liquid", "src\OrchardCore.Modules\Orchard.Liquid\Orchard.Liquid.csproj", "{F8973BF9-4F56-4A59-9153-72BEDB6AB269}"
 EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Orchard.Lucene.Core", "src\OrchardCore\Orchard.Lucene.Core\Orchard.Lucene.Core.csproj", "{F621B369-15FD-4923-98AD-17740C24CD5C}"
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Orchard.Lucene.Core", "src\OrchardCore\Orchard.Lucene.Core\Orchard.Lucene.Core.csproj", "{F621B369-15FD-4923-98AD-17740C24CD5C}"
 EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Orchard.Queries.Abstractions", "src\OrchardCore\Orchard.Queries.Abstractions\Orchard.Queries.Abstractions.csproj", "{AEB44D2A-1493-4550-8B13-EB611B1FB12C}"
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Orchard.Queries.Abstractions", "src\OrchardCore\Orchard.Queries.Abstractions\Orchard.Queries.Abstractions.csproj", "{AEB44D2A-1493-4550-8B13-EB611B1FB12C}"
 EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Orchard.Entities", "src\OrchardCore\Orchard.Entities\Orchard.Entities.csproj", "{875C2E27-A131-44AF-9130-6C6CD93317C9}"
 EndProject
@@ -271,6 +271,8 @@ Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Orchard.Tokens.Core", "src\
 EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Orchard.Diagnostics.Elm", "src\OrchardCore.Modules\Orchard.Diagnostics.Elm\Orchard.Diagnostics.Elm.csproj", "{A1B6C857-7844-433E-B28A-9A86600771A2}"
 EndProject
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Orchard.Cors", "src\OrchardCore.Modules\Orchard.Cors\Orchard.Cors.csproj", "{1D2EF8FF-72D6-48C6-8E2B-54F5E28F90C0}"
+EndProject
 Global
  GlobalSection(SolutionConfigurationPlatforms) = preSolution
  Debug|Any CPU = Debug|Any CPU
@@ -753,6 +755,10 @@ Global
  {A1B6C857-7844-433E-B28A-9A86600771A2}.Debug|Any CPU.Build.0 = Debug|Any CPU
  {A1B6C857-7844-433E-B28A-9A86600771A2}.Release|Any CPU.ActiveCfg = Release|Any CPU
  {A1B6C857-7844-433E-B28A-9A86600771A2}.Release|Any CPU.Build.0 = Release|Any CPU
+ {1D2EF8FF-72D6-48C6-8E2B-54F5E28F90C0}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+ {1D2EF8FF-72D6-48C6-8E2B-54F5E28F90C0}.Debug|Any CPU.Build.0 = Debug|Any CPU
+ {1D2EF8FF-72D6-48C6-8E2B-54F5E28F90C0}.Release|Any CPU.ActiveCfg = Release|Any CPU
+ {1D2EF8FF-72D6-48C6-8E2B-54F5E28F90C0}.Release|Any CPU.Build.0 = Release|Any CPU
  EndGlobalSection
  GlobalSection(SolutionProperties) = preSolution
  HideSolutionNode = FALSE
@@ -890,5 +896,6 @@ Global
  {391F8D42-43B0-4DA5-A727-083ABBA55510} = {F23AC6C2-DE44-4699-999D-3C478EF3D691}
  {5F6C21D3-7D8B-4CAE-9298-CA6791A13FC0} = {F23AC6C2-DE44-4699-999D-3C478EF3D691}
  {A1B6C857-7844-433E-B28A-9A86600771A2} = {A066395F-6F73-45DC-B5A6-B4E306110DCE}
+ {1D2EF8FF-72D6-48C6-8E2B-54F5E28F90C0} = {A066395F-6F73-45DC-B5A6-B4E306110DCE}
  EndGlobalSection
 EndGlobal

src/OrchardCore.Modules/Orchard.Cors/CorsMvcStartup.cs

@@ -0,0 +1,19 @@
+using Microsoft.AspNetCore.Modules;
+using Microsoft.AspNetCore.Mvc.ApplicationModels;
+using Microsoft.AspNetCore.Mvc.Cors;
+using Microsoft.AspNetCore.Mvc.Cors.Internal;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection.Extensions;
+
+namespace Orchard.Cors
+{
+ [Feature("Orchard.Cors.Mvc")]
+ public class CorsMvcStartup : StartupBase
+ {
+ public override void ConfigureServices(IServiceCollection services)
+ {
+ services.TryAddEnumerable(ServiceDescriptor.Transient<IApplicationModelProvider, CorsApplicationModelProvider>());
+ services.TryAddTransient<CorsAuthorizationFilter, CorsAuthorizationFilter>();
+ }
+ }
+}

src/OrchardCore.Modules/Orchard.Cors/CorsStartup.cs

@@ -0,0 +1,13 @@
+using Microsoft.AspNetCore.Modules;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Orchard.Cors
+{
+ public class CorsStartup : StartupBase
+ {
+ public override void ConfigureServices(IServiceCollection services)
+ {
+ services.AddCors();
+ }
+ }
+}

src/OrchardCore.Modules/Orchard.Cors/Module.txt

@@ -0,0 +1,19 @@
+Name: Cors
+AntiForgery: enabled
+Author: The Orchard Team
+Website: http://orchardproject.net
+Version: 2.0.x
+OrchardVersion: 2.0.x
+Description: Adds Cross-Origin Resource Sharing
+Priority: 1
+Category: Security
+Features:
+ Orchard.Cors:
+ Name: Cors
+ Description: Feature Adds CORS services.
+ Category: Security
+ Orchard.Cors.Mvc:
+ Name: Cors Mvc
+ Description: Feature allows apply CORS policies per Mvc Controller or Action.
+ Dependencies: Orchard.Cors
+ Category: Security

src/OrchardCore.Modules/Orchard.Cors/Orchard.Cors.csproj

@@ -0,0 +1,16 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+ <PropertyGroup>
+ <TargetFramework>netstandard1.6</TargetFramework>
+ <Description>Cross-Origin Resource Sharing Feature</Description>
+ </PropertyGroup>
+
+ <ItemGroup>
+ <PackageReference Include="Microsoft.AspNetCore.Mvc.Cors" Version="1.1.2" />
+ </ItemGroup>
+
+ <ItemGroup>
+ <ProjectReference Include="..\..\OrchardCore\OrchardCore.AsModule\OrchardCore.AsModule.csproj" />
+ </ItemGroup>
+
+</Project>

src/OrchardCore.Modules/Orchard.OpenId/Constants.cs

@@ -0,0 +1,8 @@
+namespace Orchard.OpenId
+{
+ public class Constants
+ {
+ public const string OpenIdConnectUserInfoPolicy = "Orchard.OpenId.OpenIdConnectUserInfoPolicy";
+ public const string OpenIdConnectAuthPolicy = "Orchard.OpenId.OpenIdConnectAuthPolicy";
+ }
+}

src/OrchardCore.Modules/Orchard.OpenId/Controllers/AccessController.cs

@@ -9,6 +9,8 @@
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Cors;
+using Microsoft.AspNetCore.Cors.Infrastructure;
 using Microsoft.AspNetCore.Http.Authentication;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.AspNetCore.Mvc;
@@ -132,6 +134,7 @@ public async Task<IActionResult> Authorize()
 
  [ActionName(nameof(Authorize))]
  [HttpPost, FormValueRequired("submit.Accept")]
+ [EnableCors(Constants.OpenIdConnectAuthPolicy)]
  public async Task<IActionResult> Accept()
  {
  var response = HttpContext.GetOpenIdConnectResponse();
@@ -217,6 +220,7 @@ public async Task<IActionResult> Logout()
  [AllowAnonymous, HttpPost]
  [IgnoreAntiforgeryToken]
  [Produces("application/json")]
+ [EnableCors(Constants.OpenIdConnectAuthPolicy)]
  public async Task<IActionResult> Token()
  {
  // Warning: this action is decorated with IgnoreAntiforgeryTokenAttribute to override

src/OrchardCore.Modules/Orchard.OpenId/Controllers/AdminController.cs

@@ -137,7 +137,8 @@ public async Task<IActionResult> Edit(string id, string returnUrl = null)
  AllowClientCredentialsFlow = application.AllowClientCredentialsFlow,
  AllowImplicitFlow = application.AllowImplicitFlow,
  AllowPasswordFlow = application.AllowPasswordFlow,
- AllowRefreshTokenFlow = application.AllowRefreshTokenFlow
+ AllowRefreshTokenFlow = application.AllowRefreshTokenFlow,
+ AllowedOrigins = application.AllowedOrigins
  };
 
  ViewData["OpenIdSettings"] = openIdSettings;
@@ -211,6 +212,7 @@ public async Task<IActionResult> Edit(EditOpenIdApplicationViewModel model, stri
  application.AllowPasswordFlow = model.AllowPasswordFlow;
  application.AllowRefreshTokenFlow = model.AllowRefreshTokenFlow;
  application.AllowHybridFlow = model.AllowHybridFlow;
+ application.AllowedOrigins = model.AllowedOrigins;
 
  application.RoleNames = new List<string>();
  if (application.Type == ClientType.Confidential && application.AllowClientCredentialsFlow)
@@ -310,7 +312,8 @@ public async Task<IActionResult> Create(CreateOpenIdApplicationViewModel model,
  AllowImplicitFlow = model.AllowImplicitFlow,
  AllowPasswordFlow = model.AllowPasswordFlow,
  AllowRefreshTokenFlow = model.AllowRefreshTokenFlow,
- AllowHybridFlow = model.AllowHybridFlow
+ AllowHybridFlow = model.AllowHybridFlow,
+ AllowedOrigins = model.AllowedOrigins
  };
 
  await _applicationManager.CreateAsync(application, model.ClientSecret, HttpContext.RequestAborted);

src/OrchardCore.Modules/Orchard.OpenId/Controllers/UserInfoController.cs

@@ -2,6 +2,7 @@
 using AspNet.Security.OAuth.Validation;
 using AspNet.Security.OpenIdConnect.Primitives;
 using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Cors;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Localization;
@@ -29,6 +30,7 @@ public UserInfoController(
  [HttpGet]
  [IgnoreAntiforgeryToken]
  [Produces("application/json")]
+ [EnableCors(Constants.OpenIdConnectUserInfoPolicy)]
  public async Task<IActionResult> Me()
  {
  // Warning: this action is decorated with IgnoreAntiforgeryTokenAttribute to override

src/OrchardCore.Modules/Orchard.OpenId/ModelBinders/UrlsAttribute.cs

@@ -0,0 +1,40 @@
+using System;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Mvc.Internal;
+using Microsoft.AspNetCore.Mvc.ModelBinding;
+
+namespace Orchard.OpenId.ModelBinders
+{
+ public class UrlsBinder : IModelBinder
+ {
+
+ public Task BindModelAsync(ModelBindingContext bindingContext)
+ {
+ var valueProviderResult = bindingContext.ValueProvider.GetValue(bindingContext.FieldName);
+ if (valueProviderResult.Length > 0)
+ {
+ var valueAsString = valueProviderResult.FirstValue;
+
+ if (!string.IsNullOrEmpty(valueAsString))
+ {
+ var origins = valueAsString
+ .Split(new[]{","}, StringSplitOptions.RemoveEmptyEntries)
+ .Select(origin=>origin.Trim())
+ .ToArray();
+ if (origins.All(origin => Uri.IsWellFormedUriString(origin, UriKind.Absolute)))
+ {
+ bindingContext.Result = ModelBindingResult.Success(origins);
+ }
+ else
+ {
+ bindingContext.Result = ModelBindingResult.Success(origins);
+ bindingContext.ModelState.AddModelError(bindingContext.FieldName,"Please specify Url(s) in correct format");
+
+ }
+ }
+ }
+ return TaskCache.CompletedTask;
+ }
+ }
+}

src/OrchardCore.Modules/Orchard.OpenId/Models/OpenIdApplication.cs

@@ -68,6 +68,11 @@ public class OpenIdApplication
  public bool AllowRefreshTokenFlow { get; set; }
  public bool AllowImplicitFlow { get; set; }
  public bool AllowHybridFlow { get; set; }
+
+ /// <summary>
+ /// Cross site Origins, who can make Requests
+ /// </summary>
+ public string[] AllowedOrigins { get; set; }
  }
 
  public enum ClientType

src/OrchardCore.Modules/Orchard.OpenId/Module.txt

@@ -6,5 +6,5 @@ Version: 2.0.x
 OrchardVersion: 2.0.x
 Description: The OpenID module enables authentication of external apps through OpenID Connect.
 FeatureDescription: OpenID Connect apps management and authentication.
-Dependencies: Orchard.Users, Orchard.Roles, Orchard.Settings
+Dependencies: Orchard.Users, Orchard.Roles, Orchard.Settings, Orchard.Cors.Mvc
 Category: Security

src/OrchardCore.Modules/Orchard.OpenId/Recipes/OpenIdApplicationStep.cs

@@ -47,6 +47,7 @@ public async Task ExecuteAsync(RecipeExecutionContext context)
  application.SkipConsent = model.SkipConsent;
  application.RoleNames = model.RoleNames;
  application.Type = model.Type;
+ application.AllowedOrigins = model.AllowedOrigins;
 
  if (model.Type == ClientType.Confidential)
  {
@@ -77,5 +78,6 @@ public class OpenIdApplicationStepModel
  public bool AllowRefreshTokenFlow { get; set; }
  public bool AllowImplicitFlow { get; set; }
  public bool AllowHybridFlow { get; set; }
+ public string[] AllowedOrigins { get; set; }
  }
 }

src/OrchardCore.Modules/Orchard.OpenId/Services/OpenIdApplicationStore.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Globalization;
 using System.Threading;
@@ -196,5 +196,10 @@ public Task<int> GetCount()
  {
  return _session.Query<OpenIdApplication, OpenIdApplicationIndex>().CountAsync();
  }
+
+ public Task<IEnumerable<OpenIdApplication>> GetAllApps()
+ {
+ return _session.Query<OpenIdApplication, OpenIdApplicationIndex>().ListAsync();
+ }
  }
 }

src/OrchardCore.Modules/Orchard.OpenId/Services/OpenIdCorsConfiguration.cs

@@ -0,0 +1,51 @@
+using System.Collections.Generic;
+using System.Linq;
+using Microsoft.AspNetCore.Cors.Infrastructure;
+using Microsoft.AspNetCore.Modules;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Options;
+using Orchard.OpenId.Models;
+
+namespace Orchard.OpenId.Services
+{
+ [RequireFeatures("Orchard.Cors.Mvc")]
+ public class OpenIdCorsConfiguration : IConfigureOptions<CorsOptions>
+ {
+ private readonly OpenIdApplicationStore _openIdApplicationStore;
+
+ public OpenIdCorsConfiguration(OpenIdApplicationStore openIdService)
+ {
+ _openIdApplicationStore = openIdService;
+ }
+
+ public void Configure(CorsOptions options)
+ {
+ var openIdApplications = _openIdApplicationStore.GetAllApps().GetAwaiter().GetResult().ToList();
+ if (openIdApplications == null || openIdApplications.Count==0) return;
+ var appOrigins = openIdApplications
+ .Where(app => (app.AllowPasswordFlow || app.AllowClientCredentialsFlow || app.AllowRefreshTokenFlow) 
+ && app.AllowedOrigins != null && app.AllowedOrigins.Any())
+ .SelectMany(app => app.AllowedOrigins)
+ .ToArray();
+ if (appOrigins.Length == 0)
+ {
+ return;
+ }
+
+ //Auth end-points policy
+ options.AddPolicy(Constants.OpenIdConnectAuthPolicy, builder => builder
+ .WithOrigins(appOrigins)
+ .WithMethods("GET", "OPTIONS", "POST")
+ .WithHeaders("accept", "content-type")
+ );
+
+ //UserInfo end-point policy
+ options.AddPolicy(Constants.OpenIdConnectUserInfoPolicy, builder => builder
+ .WithOrigins(appOrigins)
+ .WithMethods("GET", "OPTIONS")
+ .WithHeaders("accept", "content-type")
+ .AllowCredentials()
+ );
+ }
+ }
+}

src/OrchardCore.Modules/Orchard.OpenId/Startup.cs

@@ -1,6 +1,7 @@
-using System;
+using System;
 using System.Diagnostics;
 using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Cors.Infrastructure;
 using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Modules;
 using Microsoft.AspNetCore.Routing;
@@ -126,6 +127,7 @@ public override void ConfigureServices(IServiceCollection services)
  });
 
  services.AddScoped<IConfigureOptions<OpenIddictOptions>, OpenIdConfiguration>();
+ services.AddSingleton<IConfigureOptions<CorsOptions>, OpenIdCorsConfiguration>();
  }
  }
 }

src/OrchardCore.Modules/Orchard.OpenId/ViewModels/CreateOpenIdApplicationViewModel.cs

@@ -1,6 +1,9 @@
-using Orchard.OpenId.Models;
+using System;
+using Orchard.OpenId.Models;
 using System.Collections.Generic;
 using System.ComponentModel.DataAnnotations;
+using Microsoft.AspNetCore.Mvc;
+using Orchard.OpenId.ModelBinders;
 
 namespace Orchard.OpenId.ViewModels
 {
@@ -28,6 +31,8 @@ public class CreateOpenIdApplicationViewModel
  public bool AllowRefreshTokenFlow { get; set; }
  public bool AllowImplicitFlow { get; set; }
  public bool AllowHybridFlow { get; set; }
+ [ModelBinder(BinderType = typeof(UrlsBinder))]
+ public string[] AllowedOrigins { get; set; }
  }
 
  public class RoleEntry