xTr1m/GameList
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Switch to signed cookie auth and stop leaking player IDs

Browse Source
This commit is contained in:
Frank Tovar
2026-02-05 16:28:22 +01:00
parent 67453d0756
commit a6265e8656
12 changed files with 100 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files

72
Infrastructure/PlayerIdentityExtensions.cs
View File

@@ -1,3 +1,7 @@
using System.Security.Claims;
using GameList.Domain;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Diagnostics;
namespace GameList.Infrastructure;
@@ -5,65 +9,27 @@ namespace GameList.Infrastructure;
public static class PlayerIdentityExtensions
{
public const string PlayerCookieName = "player";
public const string PlayerUsernameCookieName = "player_username";
public const string AdminClaim = "is_admin";
public const string AdminPolicy = "AdminOnly";
public static IApplicationBuilder UsePlayerIdentity(this IApplicationBuilder app)
public static async Task SignInPlayerAsync(HttpContext ctx, Player player)
{
app.Use(async (ctx, next) =>
var claims = new List<Claim>
{
var pathBase = ctx.Request.PathBase.HasValue ? ctx.Request.PathBase.Value : "/";
var isHttps = string.Equals(ctx.Request.Scheme, "https", StringComparison.OrdinalIgnoreCase);
Guid playerId;
if (!ctx.Request.Cookies.TryGetValue(PlayerCookieName, out var value) || !Guid.TryParse(value, out playerId))
{
await next();
return;
}
IssuePlayerCookie(ctx, playerId);
await next();
});
return app;
}
public static void IssuePlayerCookie(HttpContext ctx, Guid playerId, string? username = null)
{
var options = BuildCookieOptions(ctx);
ctx.Response.Cookies.Append(PlayerCookieName, playerId.ToString(), options);
if (!string.IsNullOrWhiteSpace(username))
{
ctx.Response.Cookies.Append(PlayerUsernameCookieName, username, options);
}
ctx.Items[PlayerCookieName] = playerId;
}
public static void ClearPlayerCookie(HttpContext ctx)
{
var options = BuildCookieOptions(ctx);
options.Expires = DateTimeOffset.UtcNow.AddDays(-1);
ctx.Response.Cookies.Append(PlayerCookieName, string.Empty, options);
ctx.Response.Cookies.Append(PlayerUsernameCookieName, string.Empty, options);
ctx.Items.Remove(PlayerCookieName);
}
private static CookieOptions BuildCookieOptions(HttpContext ctx)
{
var pathBase = ctx.Request.PathBase.HasValue ? ctx.Request.PathBase.Value : "/";
var isHttps = string.Equals(ctx.Request.Scheme, "https", StringComparison.OrdinalIgnoreCase);
return new CookieOptions
{
HttpOnly = true,
SameSite = SameSiteMode.Strict,
Secure = isHttps,
IsEssential = true,
Expires = DateTimeOffset.UtcNow.AddYears(1),
Path = pathBase
new Claim(ClaimTypes.NameIdentifier, player.Id.ToString()),
new Claim(ClaimTypes.Name, player.Username),
new Claim(AdminClaim, player.IsAdmin ? "true" : "false")
};
var identity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
var principal = new ClaimsPrincipal(identity);
await ctx.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, principal);
}
public static Task SignOutPlayerAsync(HttpContext ctx)
=> ctx.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
public static IApplicationBuilder UseGlobalExceptionLogging(this IApplicationBuilder app)
{
app.UseExceptionHandler(handler =>