Enable dependency injection in Boilerplate's AppJwtSecureDataFormat (#11199) #11200
Conversation
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the WalkthroughThe changes refactor how the Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant IdentityController
participant AppJwtSecureDataFormat
participant HttpResponse
Client->>IdentityController: SignIn/Refresh
IdentityController->>AppJwtSecureDataFormat: Protect(token, context)
AppJwtSecureDataFormat->>HttpResponse: Set 'access_token' as HttpOnly cookie
IdentityController-->>Client: Return response (cookie set)
sequenceDiagram
participant Client
participant UserController
participant HttpResponse
Client->>UserController: SignOut
UserController->>HttpResponse: Delete 'access_token' cookie
UserController-->>Client: Return sign-out response
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~15 minutes Assessment against linked issues
Poem
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Services/Identity/AppJwtSecureDataFormat.cs (1)
83-98: Excellent secure cookie implementation with comprehensive security attributes.The implementation properly addresses the PR objectives by setting an HttpOnly cookie with all necessary security attributes:
HttpOnly=trueprevents XSS attacks by blocking client-side accessSecure=true(except in development) ensures HTTPS-only transmissionSameSite=Strictprovides CSRF protection- Proper expiration using the configured bearer token lifetime
The conditional check for
HttpContextToSetAccessTokenCookieensures the class remains functional when HttpContext isn't available.Consider making the cookie name configurable through app settings for better maintainability:
- "access_token", + appSettings.Identity.AccessTokenCookieName ?? "access_token",
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Knowledge Base: Disabled due to Reviews > Disable Knowledge Base setting
📒 Files selected for processing (4)
src/Templates/Boilerplate/Bit.Boilerplate/src/Client/Boilerplate.Client.Core/Services/AuthManager.cs(0 hunks)src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Controllers/Identity/IdentityController.cs(2 hunks)src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Controllers/Identity/UserController.cs(1 hunks)src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Services/Identity/AppJwtSecureDataFormat.cs(2 hunks)
💤 Files with no reviewable changes (1)
- src/Templates/Boilerplate/Bit.Boilerplate/src/Client/Boilerplate.Client.Core/Services/AuthManager.cs
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: build and test
🔇 Additional comments (4)
src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Controllers/Identity/UserController.cs (1)
69-70: Excellent security enhancement for proper cookie cleanup.The explicit deletion of the "access_token" cookie during sign-out ensures proper cleanup and prevents potential security vulnerabilities where the cookie might remain accessible after logout. This aligns perfectly with the PR objective to enhance security through server-side HttpOnly cookie management.
src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Controllers/Identity/IdentityController.cs (2)
102-104: Clean implementation enabling secure cookie functionality.The approach to cast the BearerTokenProtector and set the HttpContext is well-documented and necessary to enable server-side HttpOnly cookie management. The comment clearly explains the design constraint that prevented constructor injection.
240-242: Consistent implementation across authentication operations.The same pattern used in the SignIn method ensures consistent server-side cookie management for both initial authentication and token refresh operations. This maintains the security benefits throughout the authentication lifecycle.
src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Services/Identity/AppJwtSecureDataFormat.cs (1)
13-13: Well-designed property for HttpContext injection.The nullable HttpContext property enables flexible cookie management - the class can function with or without cookie-setting behavior based on whether this property is set. This design maintains backward compatibility while adding the new secure cookie functionality.
ysmoradi
changed the title
1 participant
closes #11199
Summary by CodeRabbit
New Features
Bug Fixes