Skip to content

Commit 51e2bea

Browse files
pranavkmpranavkm
authored
Throw if CORS policy is configured to allow credentials and any origin (#7751)
* Throw if CORS policy is configured to allow credentials and any origin Fixes #3106
1 parent 5418698 commit 51e2bea

File tree

13 files changed

+164
-177
lines changed

13 files changed

+164
-177
lines changed

‎src/Middleware/CORS/samples/SampleDestination/Startup.cs

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,7 @@ public void ConfigureServices(IServiceCollection services)
5050
options.AddPolicy("AllowAll", policy => policy
5151
.AllowAnyOrigin()
5252
.AllowAnyMethod()
53-
.AllowAnyHeader()
54-
.AllowCredentials());
53+
.AllowAnyHeader());
5554
});
5655
services.AddRouting();
5756
}

‎src/Middleware/CORS/samples/SampleDestination/StartupWithoutEndpointRouting.cs

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,8 +73,7 @@ public void Configure(IApplicationBuilder app)
7373
innerBuilder.UseCors(policy => policy
7474
.AllowAnyOrigin()
7575
.AllowAnyMethod()
76-
.AllowAnyHeader()
77-
.AllowCredentials());
76+
.AllowAnyHeader());
7877

7978
innerBuilder.UseMiddleware<SampleMiddleware>();
8079
});

‎src/Middleware/CORS/src/Infrastructure/CorsPolicyBuilder.cs

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -224,6 +224,11 @@ public CorsPolicyBuilder SetIsOriginAllowedToAllowWildcardSubdomains()
224224
/// <returns>The constructed <see cref="CorsPolicy"/>.</returns>
225225
public CorsPolicy Build()
226226
{
227+
if (_policy.AllowAnyOrigin && _policy.SupportsCredentials)
228+
{
229+
throw new InvalidOperationException(Resources.InsecureConfiguration);
230+
}
231+
227232
return _policy;
228233
}
229234

‎src/Middleware/CORS/src/Infrastructure/CorsService.cs

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@
88
using Microsoft.AspNetCore.Cors.Internal;
99
using Microsoft.AspNetCore.Http;
1010
using Microsoft.Extensions.Logging;
11-
using Microsoft.Extensions.Logging.Abstractions;
1211
using Microsoft.Extensions.Options;
1312
using Microsoft.Extensions.Primitives;
1413

@@ -77,7 +76,7 @@ public CorsResult EvaluatePolicy(HttpContext context, CorsPolicy policy)
7776

7877
if (policy.AllowAnyOrigin && policy.SupportsCredentials)
7978
{
80-
_logger.InsecureConfiguration();
79+
throw new ArgumentException(Resources.InsecureConfiguration, nameof(policy));
8180
}
8281

8382
var origin = context.Request.Headers[CorsConstants.Origin];

‎src/Middleware/CORS/src/Internal/CORSLoggerExtensions.cs

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ internal static class CORSLoggerExtensions
1818
private static readonly Action<ILogger, string, Exception> _requestHeaderNotAllowed;
1919
private static readonly Action<ILogger, Exception> _failedToSetCorsHeaders;
2020
private static readonly Action<ILogger, Exception> _noCorsPolicyFound;
21-
private static readonly Action<ILogger, Exception> _insecureConfiguration;
2221
private static readonly Action<ILogger, Exception> _isNotPreflightRequest;
2322

2423
static CORSLoggerExtensions()
@@ -73,11 +72,6 @@ static CORSLoggerExtensions()
7372
new EventId(10, "NoCorsPolicyFound"),
7473
"No CORS policy found for the specified request.");
7574

76-
_insecureConfiguration = LoggerMessage.Define(
77-
LogLevel.Warning,
78-
new EventId(11, "InsecureConfiguration"),
79-
"The CORS protocol does not allow specifying a wildcard (any) origin and credentials at the same time. Configure the policy by listing individual origins if credentials needs to be supported.");
80-
8175
_isNotPreflightRequest = LoggerMessage.Define(
8276
LogLevel.Debug,
8377
new EventId(12, "IsNotPreflightRequest"),
@@ -134,11 +128,6 @@ public static void NoCorsPolicyFound(this ILogger logger)
134128
_noCorsPolicyFound(logger, null);
135129
}
136130

137-
public static void InsecureConfiguration(this ILogger logger)
138-
{
139-
_insecureConfiguration(logger, null);
140-
}
141-
142131
public static void IsNotPreflightRequest(this ILogger logger)
143132
{
144133
_isNotPreflightRequest(logger, null);

‎src/Middleware/CORS/src/Properties/Resources.Designer.cs

Lines changed: 58 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/Middleware/CORS/src/Resources.Designer.cs

Lines changed: 0 additions & 71 deletions
This file was deleted.

‎src/Middleware/CORS/src/Resources.resx

Lines changed: 52 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<root>
3-
<!--
3+
<!--
44
Microsoft ResX Schema
55
66
Version 2.0
@@ -60,63 +60,66 @@
6060
: and then encoded with base64 encoding.
6161
-->
6262
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
63-
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
64-
<xsd:element name="root" msdata:IsDataSet="true">
65-
<xsd:complexType>
66-
<xsd:choice maxOccurs="unbounded">
67-
<xsd:element name="metadata">
68-
<xsd:complexType>
69-
<xsd:sequence>
70-
<xsd:element name="value" type="xsd:string" minOccurs="0" />
71-
</xsd:sequence>
72-
<xsd:attribute name="name" use="required" type="xsd:string" />
73-
<xsd:attribute name="type" type="xsd:string" />
74-
<xsd:attribute name="mimetype" type="xsd:string" />
75-
<xsd:attribute ref="xml:space" />
76-
</xsd:complexType>
77-
</xsd:element>
78-
<xsd:element name="assembly">
79-
<xsd:complexType>
80-
<xsd:attribute name="alias" type="xsd:string" />
81-
<xsd:attribute name="name" type="xsd:string" />
82-
</xsd:complexType>
83-
</xsd:element>
84-
<xsd:element name="data">
85-
<xsd:complexType>
86-
<xsd:sequence>
87-
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
88-
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
89-
</xsd:sequence>
90-
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
91-
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
92-
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
93-
<xsd:attribute ref="xml:space" />
94-
</xsd:complexType>
95-
</xsd:element>
96-
<xsd:element name="resheader">
97-
<xsd:complexType>
98-
<xsd:sequence>
99-
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
100-
</xsd:sequence>
101-
<xsd:attribute name="name" type="xsd:string" use="required" />
102-
</xsd:complexType>
103-
</xsd:element>
104-
</xsd:choice>
105-
</xsd:complexType>
106-
</xsd:element>
63+
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
64+
<xsd:element name="root" msdata:IsDataSet="true">
65+
<xsd:complexType>
66+
<xsd:choice maxOccurs="unbounded">
67+
<xsd:element name="metadata">
68+
<xsd:complexType>
69+
<xsd:sequence>
70+
<xsd:element name="value" type="xsd:string" minOccurs="0" />
71+
</xsd:sequence>
72+
<xsd:attribute name="name" use="required" type="xsd:string" />
73+
<xsd:attribute name="type" type="xsd:string" />
74+
<xsd:attribute name="mimetype" type="xsd:string" />
75+
<xsd:attribute ref="xml:space" />
76+
</xsd:complexType>
77+
</xsd:element>
78+
<xsd:element name="assembly">
79+
<xsd:complexType>
80+
<xsd:attribute name="alias" type="xsd:string" />
81+
<xsd:attribute name="name" type="xsd:string" />
82+
</xsd:complexType>
83+
</xsd:element>
84+
<xsd:element name="data">
85+
<xsd:complexType>
86+
<xsd:sequence>
87+
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
88+
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
89+
</xsd:sequence>
90+
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
91+
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
92+
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
93+
<xsd:attribute ref="xml:space" />
94+
</xsd:complexType>
95+
</xsd:element>
96+
<xsd:element name="resheader">
97+
<xsd:complexType>
98+
<xsd:sequence>
99+
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
100+
</xsd:sequence>
101+
<xsd:attribute name="name" type="xsd:string" use="required" />
102+
</xsd:complexType>
103+
</xsd:element>
104+
</xsd:choice>
105+
</xsd:complexType>
106+
</xsd:element>
107107
</xsd:schema>
108108
<resheader name="resmimetype">
109-
<value>text/microsoft-resx</value>
109+
<value>text/microsoft-resx</value>
110110
</resheader>
111111
<resheader name="version">
112-
<value>2.0</value>
112+
<value>2.0</value>
113113
</resheader>
114114
<resheader name="reader">
115-
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
115+
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
116116
</resheader>
117117
<resheader name="writer">
118-
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
118+
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
119119
</resheader>
120+
<data name="InsecureConfiguration" xml:space="preserve">
121+
<value>The CORS protocol does not allow specifying a wildcard (any) origin and credentials at the same time. Configure the CORS policy by listing individual origins if credentials needs to be supported.</value>
122+
</data>
120123
<data name="PreflightMaxAgeOutOfRange" xml:space="preserve">
121124
<value>PreflightMaxAge must be greater than or equal to 0.</value>
122125
</data>

‎src/Middleware/CORS/test/UnitTests/CorsPolicyBuilderTests.cs

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright (c) .NET Foundation. All rights reserved.
1+
// Copyright (c) .NET Foundation. All rights reserved.
22
// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
33

44
using System;
@@ -285,7 +285,6 @@ public void AllowCredential_SetsSupportsCredentials_ToTrue()
285285
Assert.True(corsPolicy.SupportsCredentials);
286286
}
287287

288-
289288
[Fact]
290289
public void DisallowCredential_SetsSupportsCredentials_ToFalse()
291290
{
@@ -300,6 +299,21 @@ public void DisallowCredential_SetsSupportsCredentials_ToFalse()
300299
Assert.False(corsPolicy.SupportsCredentials);
301300
}
302301

302+
[Fact]
303+
public void Build_ThrowsIfConfiguredToAllowAnyOriginWithCredentials()
304+
{
305+
// Arrange
306+
var builder = new CorsPolicyBuilder()
307+
.AllowAnyOrigin()
308+
.AllowCredentials();
309+
310+
// Act
311+
var ex = Assert.Throws<InvalidOperationException>(() => builder.Build());
312+
313+
// Assert
314+
Assert.Equal(Resources.InsecureConfiguration, ex.Message);
315+
}
316+
303317
[Theory]
304318
[InlineData("Some-String", "some-string")]
305319
[InlineData("x:\\Test", "x:\\test")]

0 commit comments

Comments
 (0)