diff --git a/LiteCharms.Features/Extensions/Api.cs b/LiteCharms.Features/Extensions/Api.cs index 0fac5fa..bd659e3 100644 --- a/LiteCharms.Features/Extensions/Api.cs +++ b/LiteCharms.Features/Extensions/Api.cs @@ -126,6 +126,21 @@ public static class Api return services; } + private static void ConfigureCookieOidcSameSiteSupport(this IServiceCollection services) => + services.Configure(options => + { + options.MinimumSameSitePolicy = SameSiteMode.Unspecified; + options.OnAppendCookie = cookieContext => CheckSameSite(cookieContext.Context, cookieContext.CookieOptions); + options.OnDeleteCookie = cookieContext => CheckSameSite(cookieContext.Context, cookieContext.CookieOptions); + }); + + private static void CheckSameSite(HttpContext httpContext, CookieOptions options) + { + if (options.SameSite == SameSiteMode.None) + if (!httpContext.Request.IsHttps && httpContext.Request.Headers["X-Forwarded-Proto"] != "https") + options.SameSite = SameSiteMode.Unspecified; + } + public static IServiceCollection AddLiteCharmsApiSecurity(this IServiceCollection services, IConfiguration configuration) { var configSection = configuration.GetSection(nameof(LiteCharmsSettings)); @@ -271,26 +286,4 @@ public static class Api public static string ToEndpointName(this Type target, string? annotation = "") => $"{target.Name.Replace("Endpoint", string.Empty)}{annotation}".ToLower(CultureInfo.CurrentCulture); - - private static void ConfigureCookieOidcSameSiteSupport(this IServiceCollection services) - { - services.Configure(options => - { - options.MinimumSameSitePolicy = SameSiteMode.Unspecified; - options.OnAppendCookie = cookieContext => CheckSameSite(cookieContext.Context, cookieContext.CookieOptions); - options.OnDeleteCookie = cookieContext => CheckSameSite(cookieContext.Context, cookieContext.CookieOptions); - }); - } - - private static void CheckSameSite(HttpContext httpContext, CookieOptions options) - { - if (options.SameSite == SameSiteMode.None) - { - // Double check that we are executing under an HTTPS routing context before emitting 'None' - if (!httpContext.Request.IsHttps && httpContext.Request.Headers["X-Forwarded-Proto"] != "https") - { - options.SameSite = SameSiteMode.Unspecified; - } - } - } }