AppStd/EnvelopeGenerator
8
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat: replace default cookie events with custom EnvelopeCookieManager and introduce custom auth cookie name (env_auth)

Browse Source
This commit is contained in:
tekh 2025-11-20 10:32:32 +01:00
parent b088eb089f
commit 8445757f34
1 changed files with 11 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
EnvelopeGenerator.Web/Program.cs
View File

@ -17,6 +17,7 @@ using EnvelopeGenerator.Web.Models.Annotation;
using DigitalData.UserManager.DependencyInjection; using DigitalData.UserManager.DependencyInjection;
using EnvelopeGenerator.Web.Middleware; using EnvelopeGenerator.Web.Middleware;
using EnvelopeGenerator.Application.Common.Interfaces.Services; using EnvelopeGenerator.Application.Common.Interfaces.Services;
using EnvelopeGenerator.Web;
var logger = LogManager.Setup().LoadConfigurationFromAppSettings().GetCurrentClassLogger(); var logger = LogManager.Setup().LoadConfigurationFromAppSettings().GetCurrentClassLogger();
logger.Info("Logging initialized!"); logger.Info("Logging initialized!");
@ -134,41 +135,22 @@ try
options.ConsentCookie.Name = "cookie-consent-settings"; options.ConsentCookie.Name = "cookie-consent-settings";
}); });
var authCookieName = "env_auth";
builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme) builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
.AddCookie(options => .AddCookie(options =>
{ {
options.Cookie.HttpOnly = true; // Makes the cookie inaccessible to client-side scripts for security options.Cookie.Name = authCookieName;
options.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest; // Ensures cookies are sent over HTTPS only options.CookieManager = new EnvelopeCookieManager(authCookieName);
options.Cookie.SameSite = SameSiteMode.Strict; // Protects against CSRF attacks by restricting how cookies are sent with requests from external sites options.Cookie.HttpOnly = true;
options.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest;
options.Cookie.SameSite = SameSiteMode.Strict;
options.ExpireTimeSpan = TimeSpan.FromMinutes(30); options.ExpireTimeSpan = TimeSpan.FromMinutes(30);
options.Events = new CookieAuthenticationEvents
{
OnRedirectToLogin = context =>
{
// Dynamically calculate the redirection path, for example:
var envelopeReceiverId = context.HttpContext.Request.RouteValues["envelopeReceiverId"];
context.RedirectUri = $"/EnvelopeKey/{envelopeReceiverId}";
context.Response.Redirect(context.RedirectUri);
return Task.CompletedTask;
},
OnRedirectToLogout = context =>
{
// Apply a similar redirection logic for logout
var envelopeReceiverId = context.HttpContext.Request.RouteValues["envelopeReceiverId"];
context.RedirectUri = $"/EnvelopeKey/{envelopeReceiverId}";
context.Response.Redirect(context.RedirectUri);
return Task.CompletedTask;
}
};
}); });
builder.Services.AddSingleton(config.GetSection("ContactLink").Get<ContactLink>() ?? new()); builder.Services.AddSingleton(config.GetSection("ContactLink").Get<ContactLink>() ?? new());
builder.Services.AddCookieBasedLocalizer(); builder.Services.AddCookieBasedLocalizer();
builder.Services.AddSingleton(HtmlEncoder.Default); builder.Services.AddSingleton(HtmlEncoder.Default);
builder.Services.AddSingleton(UrlEncoder.Default); builder.Services.AddSingleton(UrlEncoder.Default);
builder.Services.AddSanitizer<HtmlSanitizer>(); builder.Services.AddSanitizer<HtmlSanitizer>();
@ -249,7 +231,7 @@ try
app.UseAuthorization(); app.UseAuthorization();
var cultures = app.Services.GetRequiredService<Cultures>(); var cultures = app.Services.GetRequiredService<Cultures>();
if(!cultures.Any()) if (!cultures.Any())
throw new InvalidOperationException(@"Languages section is missing in the appsettings. Please configure like following. throw new InvalidOperationException(@"Languages section is missing in the appsettings. Please configure like following.
Language is both a name of the culture and the name of the resx file such as Resource.de-DE.resx Language is both a name of the culture and the name of the resx file such as Resource.de-DE.resx
FIClass is the css class (in wwwroot/lib/flag-icons-main) for the flag of country. FIClass is the css class (in wwwroot/lib/flag-icons-main) for the flag of country.
@ -264,7 +246,7 @@ try
} }
]"); ]");
if(!config.GetValue<bool>("DisableMultiLanguage")) if (!config.GetValue<bool>("DisableMultiLanguage"))
app.UseCookieBasedLocalizer(cultures.Languages.ToArray()); app.UseCookieBasedLocalizer(cultures.Languages.ToArray());
app.UseCors("SameOriginPolicy"); app.UseCors("SameOriginPolicy");
@ -273,7 +255,7 @@ try
app.MapFallbackToController("Error404", "Home"); app.MapFallbackToController("Error404", "Home");
app.Run(); app.Run();
} }
catch(Exception ex) catch (Exception ex)
{ {
logger.Error(ex, "Stopped program because of exception"); logger.Error(ex, "Stopped program because of exception");
throw; throw;