Class CorsPolicyCache

Namespace

Fdyay.IdentityServer.Services

Assembly

Fdyay.IdentityServer.Core.dll

Holds the origins an ICorsPolicyService has already allowed, and for how much longer.

public sealed class CorsPolicyCache

Inheritance

object

CorsPolicyCache

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Registered as a singleton by AddCorsPolicyCache, because the decorator in front of it follows the lifetime of the service it caches and that is usually transient.

Only allowed origins are held. A denial is answered by the inner service every time. The key of this cache is the Origin header, which is chosen by whoever is calling, so caching denials would let anyone grow it by sending origins nobody registered. Storing only what was allowed keeps the key set inside the set of origins the host's own configuration permits, and it also means a newly registered origin works immediately — the lag this cache introduces is on withdrawal, never on grant.

The cap is the second half of that, for the case the first half does not cover: a host may implement ICorsPolicyService as a pattern match — every subdomain of a tenant, say — and then the set of origins it will allow is not bounded by anything. Past MaxEntries the cache drops expired entries and, if that does not help, stops adding. Caching then degrades to asking every time, which is what this server did before the cache existed and is never a wrong answer.

Constructors

CorsPolicyCache(TimeSpan)

Creates a cache holding each allowed origin for the given duration.

public CorsPolicyCache(TimeSpan duration)

Parameters

duration TimeSpan

Fields

DefaultDuration

The cache duration AddCorsPolicyCache() uses when a host names none.

public static readonly TimeSpan DefaultDuration

Field Value

TimeSpan

Remarks

Short, because what is being cached is a permission. This is the window in which a client that has been disabled, or has had an origin taken off its registration, still reaches the protocol endpoints from the browser. A minute is long enough to absorb the repeated asking a single browser session produces — a preflight and its request, for every call an application makes — and short enough that a withdrawal a host has just made is not still in force by the time they have finished reading their own log.

MaxEntries

The most origins held at once. See the remarks on CorsPolicyCache.

public const int MaxEntries = 1000

Field Value

int

Properties

Count

How many origins are currently held, expired ones included until they are pruned.

public int Count { get; }

Property Value

int

Methods

Clear()

Forgets every cached decision, so the next request for each origin is asked afresh.

public void Clear()

Remarks

The way a host applies a withdrawal without waiting for it to expire — after disabling a client, or editing the origins on one. There is no per-origin removal because the caller who has just changed a client registration knows which client changed, not which origins are held here.