Class DefaultCorsPolicyService

Namespace

Fdyay.IdentityServer.Services

Assembly

Fdyay.IdentityServer.Core.dll

Allows a fixed list of origins, or every origin.

public class DefaultCorsPolicyService : ICorsPolicyService

Inheritance

object

DefaultCorsPolicyService

Implements

ICorsPolicyService

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

For hosts that keep their browser clients' origins in configuration rather than in the client registrations. A host whose clients carry their own AllowedCorsOrigins wants InMemoryCorsPolicyService instead.

Register it with AddDefaultCorsPolicyService, which is the only registration that can set the two properties below. Registering the type through AddCorsPolicyService<DefaultCorsPolicyService>() builds a fresh instance per request, and a fresh instance allows nothing.

Constructors

DefaultCorsPolicyService(ILogger<DefaultCorsPolicyService>)

A policy service that allows nothing until AllowAll or AllowedOrigins says otherwise.

public DefaultCorsPolicyService(ILogger<DefaultCorsPolicyService> logger)

Parameters

logger ILogger<DefaultCorsPolicyService>

Where each decision is logged.

Properties

AllowAll

Whether every origin is allowed. Defaults to false.

public bool AllowAll { get; set; }

Property Value

bool

Remarks

This disables the protection CORS provides on the protocol endpoints, so it is for local development and diagnosis. Setting it in a deployed environment lets any site script a call to the token endpoint.

AllowedOrigins

The origins allowed when AllowAll is false.

public ICollection<string> AllowedOrigins { get; }

Property Value

ICollection<string>

Remarks

Meant to be filled once, at registration. It is a plain HashSet<T>, so a host that mutates it while requests are in flight is racing the reads below.

Methods

IsOriginAllowedAsync(string, CancellationToken)

Returns true if the origin is allowed.

public Task<bool> IsOriginAllowedAsync(string origin, CancellationToken cancellationToken = default)

Parameters

origin string

cancellationToken CancellationToken

Returns

Task<bool>

Remarks

Compares origins ignoring case.