Tag: aspnetcore
All the articles with the tag "aspnetcore".
Three ways to say [Authorize], one way to check it: fixing ASP.NET Core's security-metadata guard
ASP.NET Core routing refuses to run an endpoint whose authorization metadata nothing will enforce. That guard only recognized one of the three kinds of authorization metadata. Notes on PR #67742: where the gap was, a short-circuited endpoint that served 200 without authentication on .NET 10, and the fix.
POST in, DELETE out: antiforgery and HttpMethodOverride in ASP.NET Core
UseAntiforgery() validates tokens only for POST, PUT and PATCH. Put form-field HttpMethodOverride in front of it and a cross-site POST becomes a DELETE that is never checked. Notes on PR #66772 and docs PR #37224: why the method list is what it is, a working repro on .NET 10, and what we documented.
Five minutes on the login page: an expired passkey challenge shouldn't be a 500
If a user left the login page open for more than five minutes and then signed in with a passkey, ASP.NET Core Identity threw instead of returning SignInResult.Failed. Notes on PR #67539: where the challenge actually lives, why it expires, and where to draw the line between a failed sign-in and a programming error.
"If you didn't request this, you can ignore it": the default Identity emails go to strangers too
Anyone can type any address into a register or forgot-password form, so ASP.NET Core Identity's default emails regularly reach people who never asked for them. Notes on PR #66747: where that text actually ships, a wording problem caught in review, and a test that turned out to be parsing the email.