Skip to content

Release v22.116.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 17 Oct 16:31
v22.116.0
daa7446
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Queries reached through the observable query hub are now protected by the same host authorization as their direct endpoints.

Added

  • The new IsSnapshot property on ObservableQueryEmissionContext tells an emission guard that it is admitting a one-shot snapshot result rather than a stream emission. (#2955)
  • IEndpointFallbackAuthorization evaluates the host's default authorization for a request. Arc Core requires an authenticated caller when authentication handlers are registered. ASP.NET Core hosts evaluate the configured FallbackPolicy. (#2952)

Changed

  • Subscribing to a query without [AllowAnonymous] or a guest policy over the hub's WebSocket or SSE transport now applies the host's default authorization before the query runs, as a direct request to that query does. A caller the host would turn away receives an Unauthorized frame, and SSE subscribe returns 401. [AllowAnonymous] and guest-policy queries stay reachable anonymously. (#2952)
  • Non-observable queries performed over the hub now pass the registered emission guards before their result is sent. A guard that denies sends Unauthorized; a guard that suppresses sends nothing. (#2955)

Security

  • A host FallbackPolicy, or Arc Core's requirement that callers authenticate when authentication handlers are registered, can no longer be bypassed by reaching an unannotated query through the observable query hub. (#2952)
  • An open hub connection whose session a guard revokes can no longer keep reading non-observable query results. (#2955)
Assets 2
Loading