-
Notifications
You must be signed in to change notification settings - Fork 37
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Move additional modules/extensions to shared (#9)
- Loading branch information
1 parent
ee6e0f5
commit 271e4f7
Showing
31 changed files
with
976 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
42 changes: 42 additions & 0 deletions
42
src/Microsoft.Health.Api.UnitTests/Features/Security/SecurityHeadersHelperTests.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| // ------------------------------------------------------------------------------------------------- | ||
| // Copyright (c) Microsoft Corporation. All rights reserved. | ||
| // Licensed under the MIT License (MIT). See LICENSE in the repo root for license information. | ||
| // ------------------------------------------------------------------------------------------------- | ||
|
|
||
| using System; | ||
| using Microsoft.AspNetCore.Http; | ||
| using Microsoft.Extensions.Primitives; | ||
| using Microsoft.Health.Api.Features.Security; | ||
| using Xunit; | ||
|
|
||
| namespace Microsoft.Health.Api.UnitTests.Features.Security | ||
| { | ||
| public class SecurityHeadersHelperTests | ||
| { | ||
| [Fact] | ||
| public async void GivenANullContext_WhenSettingSecurityHeaders_ThenExceptionIsThrown() | ||
| { | ||
| await Assert.ThrowsAsync<ArgumentNullException>(async () => await SecurityHeadersHelper.SetSecurityHeaders(null)); | ||
| } | ||
|
|
||
| [Fact] | ||
| public async void GivenAnIncorrectType_WhenSettingSecurityHeaders_ThenExceptionIsThrown() | ||
| { | ||
| int notAContext = 1; | ||
|
|
||
| await Assert.ThrowsAsync<ArgumentException>(async () => await SecurityHeadersHelper.SetSecurityHeaders(notAContext)); | ||
| } | ||
|
|
||
| [Fact] | ||
| public async void GivenAContext_WhenSettingSecurityHeaders_TheXContentTypeOptionsHeaderIsSet() | ||
| { | ||
| var defaultHttpContext = new DefaultHttpContext(); | ||
| await SecurityHeadersHelper.SetSecurityHeaders(defaultHttpContext); | ||
|
|
||
| Assert.NotNull(defaultHttpContext.Response.Headers); | ||
| Assert.NotEmpty(defaultHttpContext.Response.Headers); | ||
| Assert.True(defaultHttpContext.Response.Headers.TryGetValue("X-Content-Type-Options", out StringValues headerValue)); | ||
| Assert.Equal("nosniff", headerValue); | ||
| } | ||
| } | ||
| } |
17 changes: 17 additions & 0 deletions
17
src/Microsoft.Health.Api.UnitTests/Microsoft.Health.Api.UnitTests.csproj
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| <Project Sdk="Microsoft.NET.Sdk"> | ||
|
|
||
| <PropertyGroup> | ||
| <TargetFramework>netcoreapp3.1</TargetFramework> | ||
| </PropertyGroup> | ||
|
|
||
| <ItemGroup> | ||
| <PackageReference Include="Microsoft.NET.Test.Sdk" Version="16.3.0" /> | ||
| <PackageReference Include="NSubstitute" Version="4.2.1" /> | ||
| <PackageReference Include="xunit" Version="2.4.1" /> | ||
| <PackageReference Include="xunit.runner.visualstudio" Version="2.4.1" /> | ||
| </ItemGroup> | ||
|
|
||
| <ItemGroup> | ||
| <ProjectReference Include="..\Microsoft.Health.Api\Microsoft.Health.Api.csproj" /> | ||
| </ItemGroup> | ||
| </Project> |
116 changes: 116 additions & 0 deletions
116
src/Microsoft.Health.Api.UnitTests/Modules/CorsModuleTests.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,116 @@ | ||
| // ------------------------------------------------------------------------------------------------- | ||
| // Copyright (c) Microsoft Corporation. All rights reserved. | ||
| // Licensed under the MIT License (MIT). See LICENSE in the repo root for license information. | ||
| // ------------------------------------------------------------------------------------------------- | ||
|
|
||
| using System; | ||
| using Microsoft.AspNetCore.Cors.Infrastructure; | ||
| using Microsoft.Extensions.DependencyInjection; | ||
| using Microsoft.Health.Api.Configuration; | ||
| using Microsoft.Health.Api.Features.Cors; | ||
| using Microsoft.Health.Api.Modules; | ||
| using NSubstitute; | ||
| using Xunit; | ||
|
|
||
| namespace Microsoft.Health.Api.UnitTests.Modules | ||
| { | ||
| public class CorsModuleTests | ||
| { | ||
| private readonly CorsModule _corsModule; | ||
| private readonly CorsConfiguration _corsConfiguration = Substitute.For<CorsConfiguration>(); | ||
| private readonly IServiceCollection _servicesCollection = Substitute.For<IServiceCollection>(); | ||
|
|
||
| public CorsModuleTests() | ||
| { | ||
| var apiConfiguration = Substitute.For<IApiConfiguration>(); | ||
| apiConfiguration.Cors.Returns(_corsConfiguration); | ||
| _corsModule = new CorsModule(apiConfiguration); | ||
| } | ||
|
|
||
| [Fact] | ||
| public void GivenACorsConfiguration_WhenNoValuesSet_PolicyHasOnlyDefaults() | ||
| { | ||
| _corsModule.Load(_servicesCollection); | ||
|
|
||
| CorsPolicy corsPolicy = _corsModule.DefaultCorsPolicy; | ||
| Assert.Empty(corsPolicy.Origins); | ||
| Assert.Empty(corsPolicy.Headers); | ||
| Assert.Empty(corsPolicy.Methods); | ||
| Assert.False(corsPolicy.SupportsCredentials); | ||
| Assert.Null(corsPolicy.PreflightMaxAge); | ||
| } | ||
|
|
||
| [Fact] | ||
| public void GivenACorsConfiguration_WhenAllOriginsSet_PolicyHasAllowAnyOrigin() | ||
| { | ||
| _corsConfiguration.Origins.Add("*"); | ||
| _corsModule.Load(_servicesCollection); | ||
|
|
||
| Assert.True(_corsModule.DefaultCorsPolicy.AllowAnyOrigin); | ||
| } | ||
|
|
||
| [Fact] | ||
| public void GivenACorsConfiguration_WhenAllMethodsSet_PolicyHasAllowAnyMethod() | ||
| { | ||
| _corsConfiguration.Methods.Add("*"); | ||
| _corsModule.Load(_servicesCollection); | ||
|
|
||
| Assert.True(_corsModule.DefaultCorsPolicy.AllowAnyMethod); | ||
| } | ||
|
|
||
| [Fact] | ||
| public void GivenACorsConfiguration_WhenAllHeadersSet_PolicyHasAllowAnyHeader() | ||
| { | ||
| _corsConfiguration.Headers.Add("*"); | ||
| _corsModule.Load(_servicesCollection); | ||
|
|
||
| Assert.True(_corsModule.DefaultCorsPolicy.AllowAnyHeader); | ||
| } | ||
|
|
||
| [Fact] | ||
| public void GivenACorsConfiguration_WhenAllowCredentials_PolicyHasSupportsCredentials() | ||
| { | ||
| _corsConfiguration.AllowCredentials = true; | ||
| _corsModule.Load(_servicesCollection); | ||
|
|
||
| Assert.True(_corsModule.DefaultCorsPolicy.SupportsCredentials); | ||
| } | ||
|
|
||
| [Fact] | ||
| public void GivenACorsConfiguration_WhenMaxAgeSet_PolicyHasMaxAge() | ||
| { | ||
| _corsConfiguration.MaxAge = 100; | ||
| _corsModule.Load(_servicesCollection); | ||
|
|
||
| Assert.Equal(TimeSpan.FromSeconds(100), _corsModule.DefaultCorsPolicy.PreflightMaxAge); | ||
| } | ||
|
|
||
| [Fact] | ||
| public void GivenACorsConfiguration_WhenMultipleValuesSet_PolicyHasSpecifiedValues() | ||
| { | ||
| _corsConfiguration.Origins.Add("https://example.com"); | ||
| _corsConfiguration.Origins.Add("https://contoso"); | ||
|
|
||
| _corsConfiguration.Methods.Add("PATCH"); | ||
| _corsConfiguration.Methods.Add("DELETE"); | ||
|
|
||
| _corsConfiguration.Headers.Add("authorization"); | ||
| _corsConfiguration.Headers.Add("content-type"); | ||
|
|
||
| _corsModule.Load(_servicesCollection); | ||
|
|
||
| Assert.Equal(2, _corsModule.DefaultCorsPolicy.Origins.Count); | ||
| Assert.Equal(2, _corsModule.DefaultCorsPolicy.Methods.Count); | ||
| Assert.Equal(2, _corsModule.DefaultCorsPolicy.Headers.Count); | ||
|
|
||
| Assert.Contains("https://example.com", _corsModule.DefaultCorsPolicy.Origins); | ||
| Assert.Contains("https://contoso", _corsModule.DefaultCorsPolicy.Origins); | ||
|
|
||
| Assert.Contains("PATCH", _corsModule.DefaultCorsPolicy.Methods); | ||
| Assert.Contains("DELETE", _corsModule.DefaultCorsPolicy.Methods); | ||
|
|
||
| Assert.Contains("authorization", _corsModule.DefaultCorsPolicy.Headers); | ||
| Assert.Contains("content-type", _corsModule.DefaultCorsPolicy.Headers); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| // ------------------------------------------------------------------------------------------------- | ||
| // Copyright (c) Microsoft Corporation. All rights reserved. | ||
| // Licensed under the MIT License (MIT). See LICENSE in the repo root for license information. | ||
| // ------------------------------------------------------------------------------------------------- | ||
|
|
||
| using System.Resources; | ||
| using System.Runtime.CompilerServices; | ||
|
|
||
| [assembly: NeutralResourcesLanguage("en-us")] | ||
| [assembly: InternalsVisibleTo("Microsoft.Health.Api.UnitTests")] |
14 changes: 14 additions & 0 deletions
14
src/Microsoft.Health.Api/Configuration/IApiConfiguration.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,14 @@ | ||
| // ------------------------------------------------------------------------------------------------- | ||
| // Copyright (c) Microsoft Corporation. All rights reserved. | ||
| // Licensed under the MIT License (MIT). See LICENSE in the repo root for license information. | ||
| // ------------------------------------------------------------------------------------------------- | ||
|
|
||
| using Microsoft.Health.Api.Features.Cors; | ||
|
|
||
| namespace Microsoft.Health.Api.Configuration | ||
| { | ||
| public interface IApiConfiguration | ||
| { | ||
| CorsConfiguration Cors { get; } | ||
| } | ||
| } |
22 changes: 22 additions & 0 deletions
22
src/Microsoft.Health.Api/Features/Cors/CorsConfiguration.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| // ------------------------------------------------------------------------------------------------- | ||
| // Copyright (c) Microsoft Corporation. All rights reserved. | ||
| // Licensed under the MIT License (MIT). See LICENSE in the repo root for license information. | ||
| // ------------------------------------------------------------------------------------------------- | ||
|
|
||
| using System.Collections.Generic; | ||
|
|
||
| namespace Microsoft.Health.Api.Features.Cors | ||
| { | ||
| public class CorsConfiguration | ||
| { | ||
| public IList<string> Origins { get; } = new List<string>(); | ||
|
|
||
| public IList<string> Headers { get; } = new List<string>(); | ||
|
|
||
| public IList<string> Methods { get; } = new List<string>(); | ||
|
|
||
| public int? MaxAge { get; set; } | ||
|
|
||
| public bool AllowCredentials { get; set; } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| // ------------------------------------------------------------------------------------------------- | ||
| // Copyright (c) Microsoft Corporation. All rights reserved. | ||
| // Licensed under the MIT License (MIT). See LICENSE in the repo root for license information. | ||
| // ------------------------------------------------------------------------------------------------- | ||
|
|
||
| namespace Microsoft.Health.Api.Features.Cors | ||
| { | ||
| public static class CorsConstants | ||
| { | ||
| public const string DefaultCorsPolicy = "DefaultCorsPolicy"; | ||
| } | ||
| } |
32 changes: 32 additions & 0 deletions
32
src/Microsoft.Health.Api/Features/Headers/BaseHeadersMiddleware.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| // ------------------------------------------------------------------------------------------------- | ||
| // Copyright (c) Microsoft Corporation. All rights reserved. | ||
| // Licensed under the MIT License (MIT). See LICENSE in the repo root for license information. | ||
| // ------------------------------------------------------------------------------------------------- | ||
|
|
||
| using System.Threading.Tasks; | ||
| using EnsureThat; | ||
| using Microsoft.AspNetCore.Http; | ||
| using Microsoft.Health.Api.Features.Security; | ||
|
|
||
| namespace Microsoft.Health.Api.Features.Headers | ||
| { | ||
| public class BaseHeadersMiddleware | ||
| { | ||
| private readonly RequestDelegate _next; | ||
|
|
||
| public BaseHeadersMiddleware(RequestDelegate next) | ||
| { | ||
| EnsureArg.IsNotNull(next, nameof(next)); | ||
|
|
||
| _next = next; | ||
| } | ||
|
|
||
| public async Task Invoke(HttpContext context) | ||
| { | ||
| context.Response.OnStarting(SecurityHeadersHelper.SetSecurityHeaders, state: context); | ||
|
|
||
| // Call the next delegate/middleware in the pipeline | ||
| await _next(context); | ||
| } | ||
| } | ||
| } |
18 changes: 18 additions & 0 deletions
18
src/Microsoft.Health.Api/Features/Headers/BaseHeadersMiddlewareExtensions.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| // ------------------------------------------------------------------------------------------------- | ||
| // Copyright (c) Microsoft Corporation. All rights reserved. | ||
| // Licensed under the MIT License (MIT). See LICENSE in the repo root for license information. | ||
| // ------------------------------------------------------------------------------------------------- | ||
|
|
||
| using Microsoft.AspNetCore.Builder; | ||
|
|
||
| namespace Microsoft.Health.Api.Features.Headers | ||
| { | ||
| public static class BaseHeadersMiddlewareExtensions | ||
| { | ||
| public static IApplicationBuilder UseBaseHeaders( | ||
| this IApplicationBuilder builder) | ||
| { | ||
| return builder.UseMiddleware<BaseHeadersMiddleware>(); | ||
| } | ||
| } | ||
| } |
29 changes: 29 additions & 0 deletions
29
src/Microsoft.Health.Api/Features/Security/SecurityHeadersHelper.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| // ------------------------------------------------------------------------------------------------- | ||
| // Copyright (c) Microsoft Corporation. All rights reserved. | ||
| // Licensed under the MIT License (MIT). See LICENSE in the repo root for license information. | ||
| // ------------------------------------------------------------------------------------------------- | ||
|
|
||
| using System.Collections.Generic; | ||
| using System.Threading.Tasks; | ||
| using EnsureThat; | ||
| using Microsoft.AspNetCore.Http; | ||
|
|
||
| namespace Microsoft.Health.Api.Features.Security | ||
| { | ||
| internal static class SecurityHeadersHelper | ||
| { | ||
| private const string XContentTypeOptions = "X-Content-Type-Options"; | ||
| private const string XContentTypeOptionsValue = "nosniff"; | ||
|
|
||
| internal static Task SetSecurityHeaders(object context) | ||
| { | ||
| EnsureArg.IsNotNull(context, nameof(context)); | ||
| EnsureArg.IsTrue(context is HttpContext, nameof(context)); | ||
| var httpContext = (HttpContext)context; | ||
|
|
||
| httpContext.Response.Headers.TryAdd(XContentTypeOptions, XContentTypeOptionsValue); | ||
|
|
||
| return Task.CompletedTask; | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.