-
Notifications
You must be signed in to change notification settings - Fork 8
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'dotnet7' of https://github.com/genexuslabs/DotNetClasses …
…into dotnet7
- Loading branch information
Showing
43 changed files
with
4,920 additions
and
1,863 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
|
|
||
|
|
||
| using System; | ||
| using System.Threading.Tasks; | ||
| using GeneXus.Configuration; | ||
| using GeneXus.Http; | ||
| using log4net; | ||
| using Microsoft.AspNetCore.Antiforgery; | ||
| using Microsoft.AspNetCore.Http; | ||
| namespace GeneXus.Application | ||
| { | ||
| public class ValidateAntiForgeryTokenMiddleware | ||
| { | ||
| static readonly ILog log = log4net.LogManager.GetLogger(typeof(ValidateAntiForgeryTokenMiddleware)); | ||
|
|
||
| private readonly RequestDelegate _next; | ||
| private readonly IAntiforgery _antiforgery; | ||
| private string _basePath; | ||
|
|
||
| public ValidateAntiForgeryTokenMiddleware(RequestDelegate next, IAntiforgery antiforgery, String basePath) | ||
| { | ||
| _next = next; | ||
| _antiforgery = antiforgery; | ||
| _basePath = "/" + basePath; | ||
| } | ||
|
|
||
| public async Task Invoke(HttpContext context) | ||
| { | ||
| if (context.Request.Path.HasValue && context.Request.Path.Value.StartsWith(_basePath)) | ||
| { | ||
| if (HttpMethods.IsPost(context.Request.Method) || | ||
| HttpMethods.IsDelete(context.Request.Method) || | ||
| HttpMethods.IsPut(context.Request.Method)) | ||
| { | ||
| string cookieToken = context.Request.Cookies[HttpHeader.X_CSRF_TOKEN_COOKIE]; | ||
| string headerToken = context.Request.Headers[HttpHeader.X_CSRF_TOKEN_HEADER]; | ||
| GXLogging.Debug(log, $"Antiforgery validation, cookieToken:{cookieToken}, headerToken:{headerToken}"); | ||
|
|
||
| await _antiforgery.ValidateRequestAsync(context); | ||
| GXLogging.Debug(log, $"Antiforgery validation OK"); | ||
| } | ||
| else if (HttpMethods.IsGet(context.Request.Method)) | ||
| { | ||
| SetAntiForgeryTokens(_antiforgery, context); | ||
| } | ||
| } | ||
| if (!context.Request.Path.Value.EndsWith(_basePath)) //VerificationToken | ||
| await _next(context); | ||
| } | ||
| internal static void SetAntiForgeryTokens(IAntiforgery _antiforgery, HttpContext context) | ||
| { | ||
| AntiforgeryTokenSet tokenSet = _antiforgery.GetAndStoreTokens(context); | ||
| string sameSite; | ||
| CookieOptions cookieOptions = new CookieOptions { HttpOnly = false, Secure = GxContext.GetHttpSecure(context) == 1 }; | ||
| SameSiteMode sameSiteMode = SameSiteMode.Unspecified; | ||
| if (Config.GetValueOf("SAMESITE_COOKIE", out sameSite) && Enum.TryParse(sameSite, out sameSiteMode)) | ||
| { | ||
| cookieOptions.SameSite = sameSiteMode; | ||
| } | ||
| context.Response.Cookies.Append(HttpHeader.X_CSRF_TOKEN_COOKIE, tokenSet.RequestToken, cookieOptions); | ||
| GXLogging.Debug(log, $"Setting cookie ", HttpHeader.X_CSRF_TOKEN_COOKIE, "=", tokenSet.RequestToken, " samesite:" + sameSiteMode); | ||
| } | ||
|
|
||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.