Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change ForceOpen #128

Open
GFlisch opened this issue Oct 19, 2024 · 0 comments
Open

Change ForceOpen #128

GFlisch opened this issue Oct 19, 2024 · 0 comments

Comments

@GFlisch
Copy link
Owner

GFlisch commented Oct 19, 2024

Currently the Force of an OpenId connect is based on a set of string in the appsettings file based on the following pattern:
/xxxx/*
/yyyy

With the * it means everything starting with otherwise compare in a strict way.

I suggest to transform this in a Regex expression and to build this regex when the service is started (singleton) for performance.
This could also then be used for the Csp code....

The current code target is here:

        // if we have some part of the site working like a web page (like swagger, hangfire, etc...) and we need to force
        // authentication. We can add the start of the path to check and in this case we force a login!
        if (context.User is not null && context.User.Identity is not null && context.User.Identity.IsAuthenticated is false)
        {
            if (_options.ForceAuthenticationForPaths.Any(r =>
            {
                return context.Request.Path.HasValue
                       && (r.Last().Equals('*') ?
                            context.Request.Path.Value.StartsWith(r.Remove(r.Length - 1), StringComparison.OrdinalIgnoreCase)
                            :
                             context.Request.Path.Value.Equals(r, StringComparison.OrdinalIgnoreCase));
            }))
            {
                _logger.Technical().LogDebug("Force an OpenId connection.");
                var cleanUri = new Uri(new Uri(context.Request.GetEncodedUrl()).GetLeftPart(UriPartial.Path));
                if (Uri.TryCreate(_options.RedirectUrlForAuthority, UriKind.Absolute, out var authority))
                {
                    cleanUri = new Uri(authority, cleanUri.AbsolutePath);
                }
                var properties = new AuthenticationProperties() { RedirectUri = cleanUri.ToString() };
                await context.ChallengeAsync(OpenIdConnectDefaults.AuthenticationScheme, properties).ConfigureAwait(false);
                return;
            }
        }

    }
    catch (Exception ex)
    {
        _logger.Technical().LogException(ex);
    }
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant