Allow OWIN servers to register default ICookieManager instances

kevinchalet · kevinchalet · commit 4061b1bd4f9b · 2022-12-15T12:41:18.000+01:00
diff --git a/src/Microsoft.Owin.Host.SystemWeb/OwinAppContext.cs b/src/Microsoft.Owin.Host.SystemWeb/OwinAppContext.cs
@@ -59,6 +59,8 @@ internal void Initialize(Action<IAppBuilder> startup)
             builder.Properties[Constants.HostReferencedAssemblies] = new ReferencedAssembliesWrapper();
             builder.Properties[Constants.ServerCapabilitiesKey] = Capabilities;
             builder.Properties[Constants.SecurityDataProtectionProvider] = new MachineKeyDataProtectionProvider().ToOwinFunction();
+            builder.SetDefaultCookieManager(new SystemWebCookieManager());
+            builder.SetDefaultChunkingCookieManager(new SystemWebChunkingCookieManager());
             builder.SetLoggerFactory(new DiagnosticsLoggerFactory());
 
             Capabilities[Constants.SendFileVersionKey] = Constants.SendFileVersion;
diff --git a/src/Microsoft.Owin.Security.Cookies/CookieAuthenticationMiddleware.cs b/src/Microsoft.Owin.Security.Cookies/CookieAuthenticationMiddleware.cs
@@ -27,6 +27,10 @@ public class CookieAuthenticationMiddleware : AuthenticationMiddleware<CookieAut
         public CookieAuthenticationMiddleware(OwinMiddleware next, IAppBuilder app, CookieAuthenticationOptions options)
             : base(next, options)
         {
+            if (Options.CookieManager == null)
+            {
+                Options.CookieManager = app.GetDefaultChunkingCookieManager() ?? new ChunkingCookieManager();
+            }
             if (Options.Provider == null)
             {
                 Options.Provider = new CookieAuthenticationProvider();
@@ -46,10 +50,6 @@ public CookieAuthenticationMiddleware(OwinMiddleware next, IAppBuilder app, Cook
 
                 Options.TicketDataFormat = new TicketDataFormat(dataProtector);
             }
-            if (Options.CookieManager == null)
-            {
-                Options.CookieManager = new ChunkingCookieManager();
-            }
         }
 
         /// <summary>
diff --git a/src/Microsoft.Owin.Security.Cookies/CookieAuthenticationOptions.cs b/src/Microsoft.Owin.Security.Cookies/CookieAuthenticationOptions.cs
@@ -4,6 +4,7 @@
 using System;
 using System.Diagnostics.CodeAnalysis;
 using Microsoft.Owin.Infrastructure;
+using Owin;
 
 namespace Microsoft.Owin.Security.Cookies
 {
@@ -142,9 +143,11 @@ public string CookieName
 
         /// <summary>
         /// The component used to get cookies from the request or set them on the response.
-        ///
-        /// ChunkingCookieManager will be used by default.
         /// </summary>
+        /// <remarks>
+        /// The manager returned by <see cref="AppBuilderCookieExtensions.GetDefaultChunkingCookieManager(IAppBuilder)"/>
+        /// (or a default <see cref="ChunkingCookieManager"/> instance) is used by default if no value is explicitly set.
+        /// </remarks>
         public ICookieManager CookieManager { get; set; }
 
         /// <summary>
diff --git a/src/Microsoft.Owin.Security.Facebook/FacebookAuthenticationMiddleware.cs b/src/Microsoft.Owin.Security.Facebook/FacebookAuthenticationMiddleware.cs
@@ -5,6 +5,7 @@
 using System.Diagnostics.CodeAnalysis;
 using System.Globalization;
 using System.Net.Http;
+using Microsoft.Owin.Infrastructure;
 using Microsoft.Owin.Logging;
 using Microsoft.Owin.Security.DataHandler;
 using Microsoft.Owin.Security.DataProtection;
@@ -45,6 +46,10 @@ public FacebookAuthenticationMiddleware(
 
             _logger = app.CreateLogger<FacebookAuthenticationMiddleware>();
 
+            if (Options.CookieManager == null)
+            {
+                Options.CookieManager = app.GetDefaultCookieManager() ?? new CookieManager();
+            }
             if (Options.Provider == null)
             {
                 Options.Provider = new FacebookAuthenticationProvider();
diff --git a/src/Microsoft.Owin.Security.Facebook/FacebookAuthenticationOptions.cs b/src/Microsoft.Owin.Security.Facebook/FacebookAuthenticationOptions.cs
@@ -31,7 +31,6 @@ public FacebookAuthenticationOptions()
             BackchannelTimeout = TimeSpan.FromSeconds(60);
             SendAppSecretProof = true;
             _fields = new HashSet<string>();
-            CookieManager = new CookieManager();
 
             AuthorizationEndpoint = Constants.AuthorizationEndpoint;
             TokenEndpoint = Constants.TokenEndpoint;
diff --git a/src/Microsoft.Owin.Security.Google/GoogleOAuth2AuthenticationMiddleware.cs b/src/Microsoft.Owin.Security.Google/GoogleOAuth2AuthenticationMiddleware.cs
@@ -5,6 +5,7 @@
 using System.Diagnostics.CodeAnalysis;
 using System.Globalization;
 using System.Net.Http;
+using Microsoft.Owin.Infrastructure;
 using Microsoft.Owin.Logging;
 using Microsoft.Owin.Security.DataHandler;
 using Microsoft.Owin.Security.DataProtection;
@@ -47,6 +48,10 @@ public GoogleOAuth2AuthenticationMiddleware(
 
             _logger = app.CreateLogger<GoogleOAuth2AuthenticationMiddleware>();
 
+            if (Options.CookieManager == null)
+            {
+                Options.CookieManager = app.GetDefaultCookieManager() ?? new CookieManager();
+            }
             if (Options.Provider == null)
             {
                 Options.Provider = new GoogleOAuth2AuthenticationProvider();
diff --git a/src/Microsoft.Owin.Security.Google/GoogleOAuth2AuthenticationOptions.cs b/src/Microsoft.Owin.Security.Google/GoogleOAuth2AuthenticationOptions.cs
@@ -29,7 +29,6 @@ public GoogleOAuth2AuthenticationOptions()
             AuthenticationMode = AuthenticationMode.Passive;
             Scope = new List<string>();
             BackchannelTimeout = TimeSpan.FromSeconds(60);
-            CookieManager = new CookieManager();
 
             AuthorizationEndpoint = Constants.AuthorizationEndpoint;
             TokenEndpoint = Constants.TokenEndpoint;
diff --git a/src/Microsoft.Owin.Security.MicrosoftAccount/MicrosoftAccountAuthenticationMiddleware.cs b/src/Microsoft.Owin.Security.MicrosoftAccount/MicrosoftAccountAuthenticationMiddleware.cs
@@ -5,6 +5,7 @@
 using System.Diagnostics.CodeAnalysis;
 using System.Globalization;
 using System.Net.Http;
+using Microsoft.Owin.Infrastructure;
 using Microsoft.Owin.Logging;
 using Microsoft.Owin.Security.DataHandler;
 using Microsoft.Owin.Security.DataProtection;
@@ -45,6 +46,10 @@ public MicrosoftAccountAuthenticationMiddleware(
 
             _logger = app.CreateLogger<MicrosoftAccountAuthenticationMiddleware>();
 
+            if (Options.CookieManager == null)
+            {
+                Options.CookieManager = app.GetDefaultCookieManager() ?? new CookieManager();
+            }
             if (Options.Provider == null)
             {
                 Options.Provider = new MicrosoftAccountAuthenticationProvider();
diff --git a/src/Microsoft.Owin.Security.MicrosoftAccount/MicrosoftAccountAuthenticationOptions.cs b/src/Microsoft.Owin.Security.MicrosoftAccount/MicrosoftAccountAuthenticationOptions.cs
@@ -26,7 +26,6 @@ public MicrosoftAccountAuthenticationOptions() : base(Constants.DefaultAuthentic
             AuthenticationMode = AuthenticationMode.Passive;
             Scope = new List<string>();
             BackchannelTimeout = TimeSpan.FromSeconds(60);
-            CookieManager = new CookieManager();
 
             AuthorizationEndpoint = Constants.AuthorizationEndpoint;
             TokenEndpoint = Constants.TokenEndpoint;
diff --git a/src/Microsoft.Owin.Security.OpenIdConnect/OpenIdConnectAuthenticationMiddleware.cs b/src/Microsoft.Owin.Security.OpenIdConnect/OpenIdConnectAuthenticationMiddleware.cs
@@ -6,6 +6,7 @@
 using System.Net.Http;
 using Microsoft.IdentityModel.Protocols;
 using Microsoft.IdentityModel.Protocols.OpenIdConnect;
+using Microsoft.Owin.Infrastructure;
 using Microsoft.Owin.Logging;
 using Microsoft.Owin.Security.DataHandler;
 using Microsoft.Owin.Security.DataProtection;
@@ -38,6 +39,10 @@ public OpenIdConnectAuthenticationMiddleware(OwinMiddleware next, IAppBuilder ap
                 Options.TokenValidationParameters.AuthenticationType = app.GetDefaultSignInAsAuthenticationType();
             }
 
+            if (Options.CookieManager == null)
+            {
+                Options.CookieManager = app.GetDefaultCookieManager() ?? new CookieManager();
+            }
             if (Options.StateDataFormat == null)
             {
                 var dataProtector = app.CreateDataProtector(
diff --git a/src/Microsoft.Owin.Security.OpenIdConnect/OpenIdConnectAuthenticationOptions.cs b/src/Microsoft.Owin.Security.OpenIdConnect/OpenIdConnectAuthenticationOptions.cs
@@ -70,7 +70,6 @@ public OpenIdConnectAuthenticationOptions(string authenticationType)
             RequireHttpsMetadata = true;
             TokenValidationParameters = new TokenValidationParameters();
             UseTokenLifetime = true;
-            CookieManager = new CookieManager();
             RedeemCode = false;
             UsePkce = true;
         }
diff --git a/src/Microsoft.Owin.Security.Twitter/TwitterAuthenticationMiddleware.cs b/src/Microsoft.Owin.Security.Twitter/TwitterAuthenticationMiddleware.cs
@@ -5,6 +5,7 @@
 using System.Diagnostics.CodeAnalysis;
 using System.Globalization;
 using System.Net.Http;
+using Microsoft.Owin.Infrastructure;
 using Microsoft.Owin.Logging;
 using Microsoft.Owin.Security.DataHandler;
 using Microsoft.Owin.Security.DataHandler.Encoder;
@@ -48,6 +49,10 @@ public TwitterAuthenticationMiddleware(
                 throw new ArgumentException(string.Format(CultureInfo.CurrentCulture, Resources.Exception_OptionMustBeProvided, "ConsumerKey"));
             }
 
+            if (Options.CookieManager == null)
+            {
+                Options.CookieManager = app.GetDefaultCookieManager() ?? new CookieManager();
+            }
             if (Options.Provider == null)
             {
                 Options.Provider = new TwitterAuthenticationProvider();
diff --git a/src/Microsoft.Owin.Security.Twitter/TwitterAuthenticationOptions.cs b/src/Microsoft.Owin.Security.Twitter/TwitterAuthenticationOptions.cs
@@ -26,7 +26,6 @@ public TwitterAuthenticationOptions()
             CallbackPath = new PathString("/signin-twitter");
             AuthenticationMode = AuthenticationMode.Passive;
             BackchannelTimeout = TimeSpan.FromSeconds(60);
-            CookieManager = new CookieManager();
         }
 
         /// <summary>
diff --git a/src/Microsoft.Owin/Extensions/AppBuilderCookieExtensions.cs b/src/Microsoft.Owin/Extensions/AppBuilderCookieExtensions.cs
@@ -0,0 +1,111 @@
+﻿// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using Microsoft.Owin.Infrastructure;
+using Owin;
+
+namespace Microsoft.Owin
+{
+    /// <summary>
+    /// Cookie-related extensions for <see cref="IAppBuilder"/>.
+    /// </summary>
+    public static class AppBuilderCookieExtensions
+    {
+        /// <summary>
+        /// Sets the default <see cref="ICookieManager"/> that will be used by
+        /// the OWIN middleware when no manager is explicitly set in their options.
+        /// </summary>
+        /// <remarks>
+        /// Depending on the host, a default <see cref="ICookieManager"/> instance
+        /// may already be registered in <see cref="IAppBuilder.Properties"/>
+        /// (e.g SystemWeb automatically registers a cookie manager that relies on
+        /// HttpCookieCollection instead of directly manipulating the HTTP headers).
+        /// </remarks>
+        /// <param name="app">The application builder.</param>
+        /// <param name="manager">The cookie manager.</param>
+        /// <exception cref="ArgumentNullException"><paramref name="app"/> is <see langword="null"/>.</exception>
+        public static void SetDefaultCookieManager(this IAppBuilder app, ICookieManager manager)
+        {
+            if (app is null)
+            {
+                throw new ArgumentNullException(nameof(app));
+            }
+
+            if (manager is null)
+            {
+                app.Properties.Remove("infrastructure.CookieManager");
+            }
+            else
+            {
+                app.Properties["infrastructure.CookieManager"] = manager;
+            }
+        }
+
+        /// <summary>
+        /// Sets the default chunking <see cref="ICookieManager"/> that will be used
+        /// by the OWIN middleware when no manager is explicitly set in their options.
+        /// </summary>
+        /// <remarks>
+        /// Depending on the host, a default <see cref="ICookieManager"/> instance
+        /// may already be registered in <see cref="IAppBuilder.Properties"/>
+        /// (e.g SystemWeb automatically registers a cookie manager that relies on
+        /// HttpCookieCollection instead of directly manipulating the HTTP headers).
+        /// </remarks>
+        /// <param name="app">The application builder.</param>
+        /// <param name="manager">The cookie manager.</param>
+        /// <exception cref="ArgumentNullException"><paramref name="app"/> is <see langword="null"/>.</exception>
+        public static void SetDefaultChunkingCookieManager(this IAppBuilder app, ICookieManager manager)
+        {
+            if (app is null)
+            {
+                throw new ArgumentNullException(nameof(app));
+            }
+
+            if (manager is null)
+            {
+                app.Properties.Remove("infrastructure.ChunkingCookieManager");
+            }
+            else
+            {
+                app.Properties["infrastructure.ChunkingCookieManager"] = manager;
+            }
+        }
+
+        /// <summary>
+        /// Gets the default <see cref="ICookieManager"/> that will be used by
+        /// the OWIN middleware when no manager is explicitly set in their options.
+        /// </summary>
+        /// <param name="app">The application builder.</param>
+        /// <returns>The cookie manager or <see langword="null"/> if no default instance was registered.</returns>
+        /// <exception cref="ArgumentNullException"><paramref name="app"/> is <see langword="null"/>.</exception>
+        public static ICookieManager GetDefaultCookieManager(this IAppBuilder app)
+        {
+            if (app is null)
+            {
+                throw new ArgumentNullException(nameof(app));
+            }
+
+            return app.Properties.TryGetValue("infrastructure.CookieManager", out object value) &&
+                value is ICookieManager manager ? manager : null;
+        }
+
+        /// <summary>
+        /// Gets the default chunking <see cref="ICookieManager"/> that will be used
+        /// by the OWIN middleware when no manager is explicitly set in their options.
+        /// </summary>
+        /// <param name="app">The application builder.</param>
+        /// <returns>The cookie manager or <see langword="null"/> if no default instance was registered.</returns>
+        /// <exception cref="ArgumentNullException"><paramref name="app"/> is <see langword="null"/>.</exception>
+        public static ICookieManager GetDefaultChunkingCookieManager(this IAppBuilder app)
+        {
+            if (app is null)
+            {
+                throw new ArgumentNullException(nameof(app));
+            }
+
+            return app.Properties.TryGetValue("infrastructure.ChunkingCookieManager", out object value) &&
+                value is ICookieManager manager ? manager : null;
+        }
+    }
+}
diff --git a/tests/Microsoft.Owin.Tests/Builder/AppBuilderCookieTests.cs b/tests/Microsoft.Owin.Tests/Builder/AppBuilderCookieTests.cs

Original file line number	Diff line number	Diff line change
`@@ -27,6 +27,10 @@ public class CookieAuthenticationMiddleware : AuthenticationMiddleware<CookieAut`
`27`	`27`	`public CookieAuthenticationMiddleware(OwinMiddleware next, IAppBuilder app, CookieAuthenticationOptions options)`
`28`	`28`	`: base(next, options)`
`29`	`29`	`{`
	`30`	`+ if (Options.CookieManager == null)`
	`31`	`+ {`
	`32`	`+ Options.CookieManager = app.GetDefaultChunkingCookieManager() ?? new ChunkingCookieManager();`
	`33`	`+ }`
`30`	`34`	`if (Options.Provider == null)`
`31`	`35`	`{`
`32`	`36`	`Options.Provider = new CookieAuthenticationProvider();`
`@@ -46,10 +50,6 @@ public CookieAuthenticationMiddleware(OwinMiddleware next, IAppBuilder app, Cook`
`46`	`50`
`47`	`51`	`Options.TicketDataFormat = new TicketDataFormat(dataProtector);`
`48`	`52`	`}`
`49`		`- if (Options.CookieManager == null)`
`50`		`- {`
`51`		`- Options.CookieManager = new ChunkingCookieManager();`
`52`		`- }`
`53`	`53`	`}`
`54`	`54`
`55`	`55`	`/// <summary>`