- Microsoft.AspNetCore.Authentication NuGet package upgraded to 2.2.0

mihirdilip · mihirdilip · commit 3708e0d32d51 · 2019-10-25T10:06:00.000+01:00
- Microsoft.AspNetCore.All package upgraded to 2.0.9 on SampleWebApi project to fix the vulnerabilities found in the previous versions
- New SampleWebApi.Shared and SampleWebApi_2_2 project added for WebApi for .NET Core 2.2 on the github repository
- Fixed a bug in the Sample project to do with Object Null Exception
diff --git a/Mihir.AspNetCore.Authentication.Basic.sln b/Mihir.AspNetCore.Authentication.Basic.sln
@@ -1,7 +1,7 @@
 ﻿
 Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 15
-VisualStudioVersion = 15.0.27428.2011
+# Visual Studio Version 16
+VisualStudioVersion = 16.0.29418.71
 MinimumVisualStudioVersion = 10.0.40219.1
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Mihir.AspNetCore.Authentication.Basic", "Mihir.AspNetCore.Authentication.Basic\Mihir.AspNetCore.Authentication.Basic.csproj", "{F8FEFB06-9F93-4F50-8530-80F5C0A677FC}"
 EndProject
@@ -11,9 +11,16 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution
 		README.md = README.md
 	EndProjectSection
 EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "SampleWebApi", "SampleWebApi\SampleWebApi.csproj", "{1DB7BD52-D1E0-4248-819F-8424AFF55689}"
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "SampleWebApi", "SampleWebApi\SampleWebApi.csproj", "{1DB7BD52-D1E0-4248-819F-8424AFF55689}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "SampleWebApi_2_2", "SampleWebApi_2_2\SampleWebApi_2_2.csproj", "{95EF44A2-B735-425E-97D8-19DB54730E1B}"
+EndProject
+Project("{D954291E-2A0B-460D-934E-DC6B0785DB48}") = "SampleWebApi.Shared", "SampleWebApi.Shared\SampleWebApi.Shared.shproj", "{E544FB20-29F3-41F5-A78E-6164F9C43B3C}"
 EndProject
 Global
+	GlobalSection(SharedMSBuildProjectFiles) = preSolution
+		SampleWebApi.Shared\SampleWebApi.Shared.projitems*{e544fb20-29f3-41f5-a78e-6164f9c43b3c}*SharedItemsImports = 13
+	EndGlobalSection
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
 		Release|Any CPU = Release|Any CPU
@@ -27,6 +34,10 @@ Global
 		{1DB7BD52-D1E0-4248-819F-8424AFF55689}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{1DB7BD52-D1E0-4248-819F-8424AFF55689}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{1DB7BD52-D1E0-4248-819F-8424AFF55689}.Release|Any CPU.Build.0 = Release|Any CPU
+		{95EF44A2-B735-425E-97D8-19DB54730E1B}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{95EF44A2-B735-425E-97D8-19DB54730E1B}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{95EF44A2-B735-425E-97D8-19DB54730E1B}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{95EF44A2-B735-425E-97D8-19DB54730E1B}.Release|Any CPU.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
diff --git a/Mihir.AspNetCore.Authentication.Basic/Mihir.AspNetCore.Authentication.Basic.csproj b/Mihir.AspNetCore.Authentication.Basic/Mihir.AspNetCore.Authentication.Basic.csproj
@@ -4,27 +4,30 @@
     <TargetFramework>netstandard2.0</TargetFramework>
     <Authors>Mihir Dilip</Authors>
     <Company>Mihir Dilip</Company>
-    <Description>Basic Scheme Authentication Implementation for ASP.NET Core 2.0</Description>
+    <Description>Basic Scheme Authentication Implementation for ASP.NET Core 2.0 and above.</Description>
     <RepositoryUrl>https://github.com/mihirdilip/Mihir.AspNetCore.Authentication.Basic</RepositoryUrl>
     <GeneratePackageOnBuild>true</GeneratePackageOnBuild>
     <PackageProjectUrl>https://github.com/mihirdilip/Mihir.AspNetCore.Authentication.Basic</PackageProjectUrl>
-    <Version>1.0.2</Version>
-    <Copyright>Copyright (c) 2018 Mihir Dilip</Copyright>
+    <Version>2.0.0</Version>
+    <Copyright>Copyright (c) 2019 Mihir Dilip</Copyright>
     <PackageLicenseUrl>https://github.com/mihirdilip/Mihir.AspNetCore.Authentication.Basic/blob/master/LICENSE.txt</PackageLicenseUrl>
     <RepositoryType>GitHub</RepositoryType>
     <PackageIconUrl />
-    <PackageTags>asp-net-core, aspnetcore, netstandard, netstandard20, basic-authentication, basicauthentication</PackageTags>
+    <PackageTags>asp-net-core, aspnetcore, netstandard, netstandard20, basic-authentication, basicauthentication, dotnetcore, asp-net-core-basic-authentication, aspnetcore-basic-authentication, security, authentication, asp-net-core-authentication, aspnetcore-authentication</PackageTags>
     <NeutralLanguage />
     <PackageRequireLicenseAcceptance>true</PackageRequireLicenseAcceptance>
-    <PackageReleaseNotes>- Challenge property moved from BasicOptions to BasicHandler</PackageReleaseNotes>
+    <PackageReleaseNotes>- Microsoft.AspNetCore.Authentication NuGet package upgraded to 2.2.0
+- Microsoft.AspNetCore.All package upgraded to 2.0.9 on SampleWebApi project to fix the vulnerabilities found in the previous versions
+- New SampleWebApi.Shared and SampleWebApi_2_2 project added for WebApi for .NET Core 2.2 on the github repository
+- Fixed a bug in the Sample project to do with Object Null Exception</PackageReleaseNotes>
   </PropertyGroup>
 
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|AnyCPU'">
     <DocumentationFile>bin\Release\netstandard2.0\Mihir.AspNetCore.Authentication.Basic.xml</DocumentationFile>
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.Authentication" Version="2.0.3" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication" Version="2.2.0" />
   </ItemGroup>
 
 </Project>
diff --git a/SampleWebApi.Shared/Models/User.cs b/SampleWebApi.Shared/Models/User.cs
diff --git a/SampleWebApi.Shared/Repositories/IUserRepository.cs b/SampleWebApi.Shared/Repositories/IUserRepository.cs
diff --git a/SampleWebApi.Shared/Repositories/InMemoryUserRepository.cs b/SampleWebApi.Shared/Repositories/InMemoryUserRepository.cs
diff --git a/SampleWebApi.Shared/SampleWebApi.Shared.projitems b/SampleWebApi.Shared/SampleWebApi.Shared.projitems
@@ -0,0 +1,17 @@
+﻿<?xml version="1.0" encoding="utf-8"?>
+<Project xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup>
+    <MSBuildAllProjects>$(MSBuildAllProjects);$(MSBuildThisFileFullPath)</MSBuildAllProjects>
+    <HasSharedItems>true</HasSharedItems>
+    <SharedGUID>e544fb20-29f3-41f5-a78e-6164f9c43b3c</SharedGUID>
+  </PropertyGroup>
+  <PropertyGroup Label="Configuration">
+    <Import_RootNamespace>SampleWebApi.Shared</Import_RootNamespace>
+  </PropertyGroup>
+  <ItemGroup>
+    <Compile Include="$(MSBuildThisFileDirectory)Models\User.cs" />
+    <Compile Include="$(MSBuildThisFileDirectory)Repositories\InMemoryUserRepository.cs" />
+    <Compile Include="$(MSBuildThisFileDirectory)Repositories\IUserRepository.cs" />
+    <Compile Include="$(MSBuildThisFileDirectory)Services\BasicUserValidationService.cs" />
+  </ItemGroup>
+</Project>
diff --git a/SampleWebApi.Shared/SampleWebApi.Shared.shproj b/SampleWebApi.Shared/SampleWebApi.Shared.shproj
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>e544fb20-29f3-41f5-a78e-6164f9c43b3c</ProjectGuid>
+    <MinimumVisualStudioVersion>14.0</MinimumVisualStudioVersion>
+  </PropertyGroup>
+  <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
+  <Import Project="$(MSBuildExtensionsPath32)\Microsoft\VisualStudio\v$(VisualStudioVersion)\CodeSharing\Microsoft.CodeSharing.Common.Default.props" />
+  <Import Project="$(MSBuildExtensionsPath32)\Microsoft\VisualStudio\v$(VisualStudioVersion)\CodeSharing\Microsoft.CodeSharing.Common.props" />
+  <PropertyGroup />
+  <Import Project="SampleWebApi.Shared.projitems" Label="Shared" />
+  <Import Project="$(MSBuildExtensionsPath32)\Microsoft\VisualStudio\v$(VisualStudioVersion)\CodeSharing\Microsoft.CodeSharing.CSharp.targets" />
+</Project>
diff --git a/SampleWebApi.Shared/Services/BasicUserValidationService.cs b/SampleWebApi.Shared/Services/BasicUserValidationService.cs
@@ -24,7 +24,7 @@ public async Task<bool> IsValidAsync(string username, string password)
 				// NOTE: DO NOT USE THIS IMPLEMENTATION. THIS IS FOR DEMO PURPOSE ONLY
 				// Write your implementation here and return true or false depending on the validation..
 				var user = await _userRepository.GetUserByUsername(username);
-				var isValid = user.Password == password;
+				var isValid = user != null && user.Password == password;
 				return isValid;
 			}
 			catch (Exception e)
diff --git a/SampleWebApi/SampleWebApi.csproj b/SampleWebApi/SampleWebApi.csproj
@@ -9,12 +9,14 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.All" Version="2.0.6" />
+    <PackageReference Include="Microsoft.AspNetCore.All" Version="2.0.9" />
     <PackageReference Include="Mihir.AspNetCore.Authentication.Basic" Version="1.0.2" />
   </ItemGroup>
 
   <ItemGroup>
     <DotNetCliToolReference Include="Microsoft.VisualStudio.Web.CodeGeneration.Tools" Version="2.0.3" />
   </ItemGroup>
 
+  <Import Project="..\SampleWebApi.Shared\SampleWebApi.Shared.projitems" Label="Shared" />
+
 </Project>
diff --git a/SampleWebApi_2_2/Controllers/ValuesController.cs b/SampleWebApi_2_2/Controllers/ValuesController.cs
@@ -0,0 +1,45 @@
+﻿using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Mvc;
+
+namespace SampleWebApi_2_2.Controllers
+{
+	[Route("api/[controller]")]
+	[ApiController]
+	public class ValuesController : ControllerBase
+	{
+		// GET api/values
+		[HttpGet]
+		public ActionResult<IEnumerable<string>> Get()
+		{
+			return new string[] { "value1", "value2" };
+		}
+
+		// GET api/values/5
+		[HttpGet("{id}")]
+		public ActionResult<string> Get(int id)
+		{
+			return "value";
+		}
+
+		// POST api/values
+		[HttpPost]
+		public void Post([FromBody] string value)
+		{
+		}
+
+		// PUT api/values/5
+		[HttpPut("{id}")]
+		public void Put(int id, [FromBody] string value)
+		{
+		}
+
+		// DELETE api/values/5
+		[HttpDelete("{id}")]
+		public void Delete(int id)
+		{
+		}
+	}
+}
diff --git a/SampleWebApi_2_2/Program.cs b/SampleWebApi_2_2/Program.cs
@@ -0,0 +1,17 @@
+﻿using Microsoft.AspNetCore;
+using Microsoft.AspNetCore.Hosting;
+
+namespace SampleWebApi_2_2
+{
+	public class Program
+	{
+		public static void Main(string[] args)
+		{
+			CreateWebHostBuilder(args).Build().Run();
+		}
+
+		public static IWebHostBuilder CreateWebHostBuilder(string[] args) =>
+			WebHost.CreateDefaultBuilder(args)
+				.UseStartup<Startup>();
+	}
+}
diff --git a/SampleWebApi_2_2/Properties/launchSettings.json b/SampleWebApi_2_2/Properties/launchSettings.json
@@ -0,0 +1,30 @@
+﻿{
+  "$schema": "http://json.schemastore.org/launchsettings.json",
+  "iisSettings": {
+    "windowsAuthentication": false, 
+    "anonymousAuthentication": true, 
+    "iisExpress": {
+      "applicationUrl": "http://localhost:1938",
+      "sslPort": 44304
+    }
+  },
+  "profiles": {
+    "IIS Express": {
+      "commandName": "IISExpress",
+      "launchBrowser": true,
+      "launchUrl": "api/values",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      }
+    },
+    "SampleWebApi_2_2": {
+      "commandName": "Project",
+      "launchBrowser": true,
+      "launchUrl": "api/values",
+      "applicationUrl": "https://localhost:5001;http://localhost:5000",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development"
+      }
+    }
+  }
+}
diff --git a/SampleWebApi_2_2/SampleWebApi_2_2.csproj b/SampleWebApi_2_2/SampleWebApi_2_2.csproj
@@ -0,0 +1,19 @@
+﻿<Project Sdk="Microsoft.NET.Sdk.Web">
+
+  <PropertyGroup>
+    <TargetFramework>netcoreapp2.2</TargetFramework>
+    <AspNetCoreHostingModel>InProcess</AspNetCoreHostingModel>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.App" />
+    <PackageReference Include="Microsoft.AspNetCore.Razor.Design" Version="2.2.0" PrivateAssets="All" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\Mihir.AspNetCore.Authentication.Basic\Mihir.AspNetCore.Authentication.Basic.csproj" />
+  </ItemGroup>
+
+  <Import Project="..\SampleWebApi.Shared\SampleWebApi.Shared.projitems" Label="Shared" />
+
+</Project>
diff --git a/SampleWebApi_2_2/Startup.cs b/SampleWebApi_2_2/Startup.cs
@@ -0,0 +1,66 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Authorization;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Mihir.AspNetCore.Authentication.Basic;
+using SampleWebApi.Repositories;
+using SampleWebApi.Services;
+
+namespace SampleWebApi_2_2
+{
+	public class Startup
+	{
+		public Startup(IConfiguration configuration)
+		{
+			Configuration = configuration;
+		}
+
+		public IConfiguration Configuration { get; }
+
+		// This method gets called by the runtime. Use this method to add services to the container.
+		public void ConfigureServices(IServiceCollection services)
+		{
+			// Add User repository to the dependency container.
+			services.AddTransient<IUserRepository, InMemoryUserRepository>();
+
+			// Add the Basic scheme authentication here..
+			// AddBasic extension takes an implementation of IBasicUserValidationService for validating the username and password. 
+			// It also requires Realm to be set in the options.
+			services.AddAuthentication(BasicDefaults.AuthenticationScheme)
+				.AddBasic<BasicUserValidationService>(options => { options.Realm = "Sample Web API"; });
+
+			services.AddMvc(options =>
+			{
+				// ALWAYS USE HTTPS (SSL) protocol in production when using Basic authentication.
+				//options.Filters.Add<RequireHttpsAttribute>();
+
+				// All the requests will need to be authorized. 
+				// Alternatively, add [Authorize] attribute to Controller or Action Method where necessary.
+				options.Filters.Add(new AuthorizeFilter(new AuthorizationPolicyBuilder().RequireAuthenticatedUser().Build()));
+			})
+				.AddXmlSerializerFormatters()   // To enable XML along with JSON
+				.SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
+		}
+
+		// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
+		public void Configure(IApplicationBuilder app, IHostingEnvironment env)
+		{
+			if (env.IsDevelopment())
+			{
+				app.UseDeveloperExceptionPage();
+			}
+			else
+			{
+				// The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
+				app.UseHsts();
+			}
+
+			app.UseHttpsRedirection();
+			app.UseAuthentication();
+			app.UseMvc();
+		}
+	}
+}
diff --git a/SampleWebApi_2_2/appsettings.Development.json b/SampleWebApi_2_2/appsettings.Development.json
@@ -0,0 +1,9 @@
+{
+  "Logging": {
+    "LogLevel": {
+      "Default": "Debug",
+      "System": "Information",
+      "Microsoft": "Information"
+    }
+  }
+}
diff --git a/SampleWebApi_2_2/appsettings.json b/SampleWebApi_2_2/appsettings.json
@@ -0,0 +1,8 @@
+{
+  "Logging": {
+    "LogLevel": {
+      "Default": "Warning"
+    }
+  },
+  "AllowedHosts": "*"
+}

Original file line number	Diff line number	Diff line change
`@@ -24,7 +24,7 @@ public async Task<bool> IsValidAsync(string username, string password)`
`24`	`24`	`// NOTE: DO NOT USE THIS IMPLEMENTATION. THIS IS FOR DEMO PURPOSE ONLY`
`25`	`25`	`// Write your implementation here and return true or false depending on the validation..`
`26`	`26`	`var user = await _userRepository.GetUserByUsername(username);`
`27`		`- var isValid = user.Password == password;`
	`27`	`+ var isValid = user != null && user.Password == password;`
`28`	`28`	`return isValid;`
`29`	`29`	`}`
`30`	`30`	`catch (Exception e)`