Add antiforgery support

[vipwan]

#508

[murillio4]

Maybe only use middleware if antiforgery is used?

Could be done by checking if its turned "on" on any endpoint, or by some other configuration

[vipwan]

Maybe only use middleware if antiforgery is used?

Could be done by checking if its turned "on" on any endpoint, or by some other configuration

the Middlewire is really Simple, just when set EndpointDefinition.IsEnlableAntiforgery = true the validation logic is executed

(Default:false) it has no effect :)

    public async Task Invoke(HttpContext context)
    {
        //GET请求不需要防伪验证
        if (context.Request.Method == HttpMethods.Get ||
            context.Request.Method == HttpMethods.Trace ||
            context.Request.Method == HttpMethods.Options ||
            context.Request.Method == HttpMethods.Head)
        {
            await _next(context);
            return;
        }
        var endpointDefinition = context.GetEndpoint()?.Metadata.GetMetadata<EndpointDefinition>();
        if (endpointDefinition?.IsEnlableAntiforgery is true)
        {
            try
            {
                await _antiforgery.ValidateRequestAsync(context);
            }
            catch (AntiforgeryValidationException)
            {
                context.Response.StatusCode = StatusCodes.Status400BadRequest;
                await context.Response.WriteAsync("Invalid anti-forgery token");
                return;
            }
        }
        await _next(context);
    }

[dj-nitehawk]

haven't checked the code properly yet. but ideally this middleware should only be added to the pipeline if user explicitly asks to enable it during startup, something like this:

app.UseFastEndpoints(c => c.Security.EnableAntiForgeryTokens = true);

if this value is false, endpoint level EnlableAntiforgery() call should throw an exception during startup.

@vipwan think you can make that happen?

[dj-nitehawk]

actually scratch that.... lets make the user do two calls to configure antiforgery.

builder.Services.AddAntiForgery()

app.UseAntiForgery() // this will be a custom extensionmethod that registers the middleware.

and during startup if endpoints say EnableAntiForgery() and the user hasn't called AddAntiForgery() an exception should be thrown.

how about that?

[vipwan]

haven't checked the code properly yet. but ideally this middleware should only be added to the pipeline if user explicitly asks to enable it during startup, something like this:

app.UseFastEndpoints(c => c.Security.EnableAntiForgeryTokens = true);

if this value is false, endpoint level EnlableAntiforgery() call should throw an exception during startup.

@vipwan think you can make that happen?

its a good Idea

app.UseFastEndpoints(c => c.Security.EnableAntiForgeryTokens = true);

[dj-nitehawk]

i think this should be the way:

builder.Services.AddAntiForgery()

app.UseAntiForgery() // this will be a custom extensionmethod that registers the middleware.

[dj-nitehawk]

usage changed to this:

//register services
builder.Services.AddAntiForgery()

//enable middleware
app.UseAntiForgery()

//endpoint config
public override void Configure()
{
    EnableAntiforgery();
}

also changed the 400 response by middleware to use the error response builder method instead of just returning a string message.

this way it won't have any conflicts with the antiforgery support coming in .net 8 to minimal apis.

[dj-nitehawk]

@vipwan is this the correct way to spell your name in english?

FastEndpoints/Src/Library/changelog.md

Line 73 in 2b4d4eb

Thank you Wàn Yǎhǔ for the [contribution](https://github.com/FastEndpoints/FastEndpoints/pull/500).

[vipwan]

@vipwan is this the correct way to spell your name in english?

FastEndpoints/Src/Library/changelog.md

Line 73 in 2b4d4eb

Thank you Wàn Yǎhǔ for the [contribution](https://github.com/FastEndpoints/FastEndpoints/pull/500).

😃 yes,that's right