[Fixes #1133] Limit the path on the nonce and correlation id cookies #1262
Conversation
|
@javiercn, |
|
Did you intentionally skip Twitter? How about CookiePolicy? |
| @@ -332,7 +332,18 @@ protected virtual Task<bool> HandleSignOutCallbackAsync() | |||
| if (Options.ProtocolValidator.RequireNonce) | |||
| { | |||
| message.Nonce = Options.ProtocolValidator.GenerateNonce(); | |||
| WriteNonceCookie(message.Nonce); | |||
| var cookieOptions = new CookieOptions | |||
There was a problem hiding this comment.
Can you move this back inside WriteNonceCookie so it's out of the way?
|
Why not events instead of options delegates? |
|
An interesting thought, but we want a consistent pattern across the stack and most other components don't use events. |
|
@Tratcher I specifically left out anything that is not part of the OpenIdConnect middleware hierarchy. Here is the query that I used: https://github.com/aspnet/Security/search?utf8=%E2%9C%93&q=Cookies.Append&type= As for the Action<HttpContext,CookieOptions> addition for other cookies I'm going to leave that to whomever does aspnet/HttpAbstractions#853. That said, I think only twitter should have that option. We shouldn't do this in the cookiepolicy middleware as it would broaden the scope of the middleware a lot (and would require us to think more carefully of the consequences). |
No description provided.