Suppress Check For Unhandled Security Metadata #16437
Conversation
|
I don't really know what this is about, so will have to defer to Kévin. |
| { | ||
| // The Cors module is designed to handle CORS, thus we skip checking for unhandled security metadata by default. | ||
| // Additionally, skipping security metadata checks on the endpoint provides a minor performance benefit. | ||
| options.SuppressCheckForUnhandledSecurityMetadata = true; |
There was a problem hiding this comment.
This removes a check for a misconfigured application.
There was a problem hiding this comment.
How could OC end up being misconfigured?
We could configure this using a configuration provider and then set it to false just to ensure that all tests pass with it being false but use true by default
There was a problem hiding this comment.
Seems I forgot to reply to this, it's something related to what @gvkries refers to in #16437 (comment)
It's a bit annoying we can't just opt out the CORS check, but the only other option I can think of is to make the OpenID module depend on CORS so the ASP.NET CORS middleware is always present in the pipeline. |
|
I don't think it is a good idea to suppress all of these checks for the whole application. |
Fix #16429
/cc: @kevinchalet