v0.40.0-rc1000

Security

• Azure Functions enforced no authorization. On every release up to and including 0.39.0-rc1000, the isolated worker never ran the application's startup services, so authorization, authentication and CORS were not installed. Under [RequireAuthorization] or [AuthorizeGrants], a guarded HTTP route answered a caller with no credential. The trigger is emitted at AuthorizationLevel.Anonymous, so function keys were not a backstop. Fixed by #395 (#386, #412). Upgrade any Azure Functions application that uses Hardened's authorization.
• A MessagePack request body could stop the process. Bodies were read with TrustedData, which sets no depth limit, so a small, deeply nested body ended in a StackOverflowException, which cannot be caught. Bodies are now read with UntrustedData (#404). An application that set its own MessagePackSecurity keeps it.

Breaking changes

• Hardened.Shared.Testing.xUnit and Hardened.Shared.Testing.NUnit are removed, and [HardenedTest] with them. A test project uses [ModuleTest] from DependencyModules.xUnit, DependencyModules.xUnit4 or DependencyModules.NUnit. CurrentTest and ICurrentTestProvider are removed from Hardened.Shared.Testing (#424).
• A form handler answers 415 for a body that is not a form, and 413 for a url-encoded body over FormConfiguration.MaxBodyBytes. A form with more than 1,024 fields answers 400. A FormatException thrown by a handler answers 500 instead of 400 (#420).
• HAUTH002 is a new warning: [AllowAnonymous] cancels an authorization attribute on the same handler's method (#423). A build that treats warnings as errors fails on it.
• A <see cref> in a handler's doc comment now puts the name it points at into the OpenAPI summary or description, in place (#428). An exported document changes for every handler that uses one.

What's Changed

• Rewrite the documentation site by @ipjohnson in #389
• Fix UseHttps and SIGTERM on the Kestrel host, and run startup services on Azure Functions by @ipjohnson in #395
• Install Azure Functions Core Tools from its GitHub release by @ipjohnson in #403
• Read MessagePack request bodies with UntrustedData by @ipjohnson in #404
• Keep Roslyn out of applications, and stamp the release version into the assemblies by @ipjohnson in #413
• Refuse oversized and non-form bodies on form handlers, and answer a handler's FormatException with 500 by @ipjohnson in #420
• Count keys and headers against the response cache's size limit, and document cache durations from configuration by @ipjohnson in #421
• Give contract patterns a match timeout, and add [ValidateNever] to skip validation by @ipjohnson in #422
• Warn when [AllowAnonymous] cancels a handler's requirement, and document cross-site requests and public trigger services by @ipjohnson in #423
• Serve a run-time static content directory under a route prefix by @ipjohnson in #425
• Replace [HardenedTest] with DependencyModules' [ModuleTest], and remove the runner packages by @ipjohnson in #424
• Accept a Lambda deadline more than 49.7 days away by @ipjohnson in #427
• Ship symbol packages and XML documentation from every Hardened library by @ipjohnson in #428
• Release 0.40.0-rc1000 by @ipjohnson in #429

Full Changelog: v0.39.0-rc1000...v0.40.0-rc1000