Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Suppress Check For Unhandled Security Metadata #16437

Merged
merged 3 commits into from
Jul 18, 2024
Merged

Suppress Check For Unhandled Security Metadata #16437

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c8adf46
Suppress Check For Unhandled Security Metadata
MikeAlhayek Jul 12, 2024
cb22e6b
Merge branch 'main' into ma/fix-openid-cors
MikeAlhayek Jul 12, 2024
e817434
fix comments
MikeAlhayek Jul 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions src/OrchardCore/OrchardCore.Mvc.Core/Extensions/OrchardCoreBuilderExtensions.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,13 @@ public static OrchardCoreBuilder AddMvc(this OrchardCoreBuilder builder)
{
// Allows a tenant to add its own route endpoint schemes for link generation.
collection.AddSingleton<IEndpointAddressScheme<RouteValuesAddress>, ShellRouteValuesAddressScheme>();

collection.Configure<RouteOptions>(options =>
{
// The Cors module is designed to handle CORS, thus we skip checking for unhandled security metadata by default.
// Additionally, skipping security metadata checks on the endpoint provides a minor performance benefit.
options.SuppressCheckForUnhandledSecurityMetadata = true;
Copy link
Member

@hishamco hishamco Jul 13, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This removes a check for a misconfigured application.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How could OC end up being misconfigured?

We could configure this using a configuration provider and then set it to false just to ensure that all tests pass with it being false but use true by default

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems I forgot to reply to this, it's something related to what @gvkries refers to in #16437 (comment)

});
},
// Need to be registered last.
order: int.MaxValue - 100);
Expand Down