Class CorsPolicyProvider

Namespace

Fdyay.IdentityServer.Hosting

Assembly

Fdyay.IdentityServer.AspNetCore.dll

Supplies the CORS policy for the protocol endpoints, deferring to the host's own provider everywhere else.

public sealed class CorsPolicyProvider : ICorsPolicyProvider

Inheritance

object

CorsPolicyProvider

Implements

ICorsPolicyProvider

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

This decorates whatever ICorsPolicyProvider was registered before it, and answers only for the paths in CorsPaths. Every other request — including the host's own endpoints — goes to the inner provider untouched, so adding the identity server does not take over a host's CORS configuration.

The allowed origins come from ICorsPolicyService rather than from a policy the host names, so that origins can be decided per request against client registrations instead of being fixed at startup.

Constructors

CorsPolicyProvider(ICorsPolicyProvider, IOptions<IdentityServerOptions>)

Decorates the CORS policy provider registered before this one.

public CorsPolicyProvider(ICorsPolicyProvider inner, IOptions<IdentityServerOptions> options)

Parameters

inner ICorsPolicyProvider

The provider every request outside the protocol endpoints' CORS paths is handed to.

options IOptions<IdentityServerOptions>

The server options; their Cors section names the policy and the paths it covers.

Methods

GetPolicyAsync(HttpContext, string?)

The policy for a protocol endpoint named by Cors.CorsPolicyName: the request's origin, any header and any method, without credentials — or null when the origin is absent or ICorsPolicyService refuses it. Every other request is answered by the inner provider.

public Task<CorsPolicy?> GetPolicyAsync(HttpContext context, string? policyName)

Parameters

context HttpContext

The request the policy is for.

policyName string

The policy the endpoint asks for.

Returns

Task<CorsPolicy>

The policy, or null for no CORS headers.