Inject CORS middleware at specialization in Linux consumption. Resolves #4889

kashimiz · fabiocav · commit 8df66d1bf7cf · 2019-10-23T15:05:52.000-07:00
diff --git a/src/WebJobs.Script.WebHost/Configuration/CorsOptionsSetup.cs b/src/WebJobs.Script.WebHost/Configuration/CorsOptionsSetup.cs
@@ -0,0 +1,41 @@
+﻿// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for license information.
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Cors.Infrastructure;
+using Microsoft.Extensions.Options;
+
+namespace Microsoft.Azure.WebJobs.Script.WebHost.Configuration
+{
+    public class CorsOptionsSetup : IConfigureOptions<CorsOptions>
+    {
+        private readonly IEnvironment _env;
+        private readonly IOptions<HostCorsOptions> _hostCorsOptions;
+
+        public CorsOptionsSetup(IEnvironment env, IOptions<HostCorsOptions> hostCorsOptions)
+        {
+            _env = env;
+            _hostCorsOptions = hostCorsOptions;
+        }
+
+        public void Configure(CorsOptions options)
+        {
+            if (_env.IsLinuxConsumption() && _hostCorsOptions.Value != null)
+            {
+                string[] allowedOrigins = _hostCorsOptions.Value.AllowedOrigins?.ToArray() ?? Array.Empty<string>();
+                var policyBuilder = new CorsPolicyBuilder(allowedOrigins);
+
+                if (_hostCorsOptions.Value.SupportCredentials)
+                {
+                    policyBuilder = policyBuilder.AllowCredentials();
+                }
+
+                var policy = policyBuilder.Build();
+                options.AddDefaultPolicy(policy);
+            }
+        }
+    }
+}
diff --git a/src/WebJobs.Script.WebHost/Configuration/HostCorsOptions.cs b/src/WebJobs.Script.WebHost/Configuration/HostCorsOptions.cs
@@ -0,0 +1,14 @@
+﻿// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for license information.
+
+using System.Collections.Generic;
+
+namespace Microsoft.Azure.WebJobs.Script.WebHost.Configuration
+{
+    public class HostCorsOptions
+    {
+        public IEnumerable<string> AllowedOrigins { get; set; }
+
+        public bool SupportCredentials { get; set; }
+    }
+}
diff --git a/src/WebJobs.Script.WebHost/Configuration/HostCorsOptionsSetup.cs b/src/WebJobs.Script.WebHost/Configuration/HostCorsOptionsSetup.cs
@@ -0,0 +1,36 @@
+﻿// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for license information.
+
+using System;
+using System.Collections.Generic;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Options;
+using Newtonsoft.Json;
+
+namespace Microsoft.Azure.WebJobs.Script.WebHost.Configuration
+{
+    public class HostCorsOptionsSetup : IConfigureOptions<HostCorsOptions>
+    {
+        private readonly IConfiguration _configuration;
+
+        public HostCorsOptionsSetup(IConfiguration configuration)
+        {
+            _configuration = configuration;
+        }
+
+        public void Configure(HostCorsOptions options)
+        {
+            var allowedOriginsString = _configuration.GetValue<string>(EnvironmentSettingNames.CorsAllowedOrigins);
+
+            IEnumerable<string> corsAllowedOrigins = Array.Empty<string>();
+            if (!string.IsNullOrWhiteSpace(allowedOriginsString))
+            {
+                corsAllowedOrigins = JsonConvert.DeserializeObject<IEnumerable<string>>(allowedOriginsString);
+            }
+            options.AllowedOrigins = corsAllowedOrigins;
+
+            var supportCredentialsString = _configuration.GetValue<bool?>(EnvironmentSettingNames.CorsSupportCredentials);
+            options.SupportCredentials = supportCredentialsString ?? false;
+        }
+    }
+}
diff --git a/src/WebJobs.Script.WebHost/Middleware/CorsConfigurationMiddleware.cs b/src/WebJobs.Script.WebHost/Middleware/CorsConfigurationMiddleware.cs
@@ -0,0 +1,46 @@
+﻿// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for license information.
+
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Cors.Infrastructure;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Azure.WebJobs.Script.Middleware;
+using Microsoft.Azure.WebJobs.Script.WebHost.Configuration;
+using Microsoft.Extensions.Options;
+
+namespace Microsoft.Azure.WebJobs.Script.WebHost.Middleware
+{
+    public class CorsConfigurationMiddleware : IJobHostHttpMiddleware
+    {
+        private RequestDelegate _invoke;
+
+        public CorsConfigurationMiddleware(IOptions<HostCorsOptions> hostCorsOptions, ICorsMiddlewareFactory middlewareFactory)
+        {
+            RequestDelegate contextNext = async context =>
+            {
+                if (context.Items.Remove(ScriptConstants.CorsMiddlewareRequestDelegate, out object requestDelegate) && requestDelegate is RequestDelegate next)
+                {
+                    await next(context);
+                }
+            };
+
+            var corsMiddleware = middlewareFactory.CreateCorsMiddleware(contextNext, hostCorsOptions);
+            if (corsMiddleware != null)
+            {
+                _invoke = corsMiddleware.Invoke;
+            }
+            else
+            {
+                _invoke = contextNext;
+            }
+        }
+
+        public async Task Invoke(HttpContext context, RequestDelegate next)
+        {
+            context.Items.Add(ScriptConstants.CorsMiddlewareRequestDelegate, next);
+            await _invoke(context);
+        }
+    }
+}
diff --git a/src/WebJobs.Script.WebHost/Middleware/CorsMiddlewareFactory.cs b/src/WebJobs.Script.WebHost/Middleware/CorsMiddlewareFactory.cs
@@ -0,0 +1,35 @@
+﻿// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System;
+using System.Linq;
+using Microsoft.AspNetCore.Cors.Infrastructure;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Azure.WebJobs.Script.WebHost.Configuration;
+using Microsoft.Extensions.Options;
+
+namespace Microsoft.Azure.WebJobs.Script.WebHost.Middleware
+{
+    public class CorsMiddlewareFactory : ICorsMiddlewareFactory
+    {
+        private readonly IOptions<CorsOptions> _corsOptions;
+
+        public CorsMiddlewareFactory(IOptions<CorsOptions> corsOptions)
+        {
+            _corsOptions = corsOptions;
+        }
+
+        public CorsMiddleware CreateCorsMiddleware(RequestDelegate next, IOptions<HostCorsOptions> corsOptions)
+        {
+            CorsMiddleware middleware = null;
+            if (corsOptions?.Value != null)
+            {
+                var corsService = new CorsService(_corsOptions);
+                var policy = _corsOptions.Value.GetPolicy(_corsOptions.Value.DefaultPolicyName);
+                middleware = new CorsMiddleware(next, corsService, policy);
+            }
+
+            return middleware;
+        }
+    }
+}
diff --git a/src/WebJobs.Script.WebHost/Middleware/ICorsMiddlewareFactory.cs b/src/WebJobs.Script.WebHost/Middleware/ICorsMiddlewareFactory.cs
@@ -0,0 +1,15 @@
+﻿// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the MIT License. See License.txt in the project root for license information.
+
+using Microsoft.AspNetCore.Cors.Infrastructure;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Azure.WebJobs.Script.WebHost.Configuration;
+using Microsoft.Extensions.Options;
+
+namespace Microsoft.Azure.WebJobs.Script.WebHost.Middleware
+{
+    public interface ICorsMiddlewareFactory
+    {
+        CorsMiddleware CreateCorsMiddleware(RequestDelegate next, IOptions<HostCorsOptions> corsOptions);
+    }
+}
diff --git a/src/WebJobs.Script.WebHost/Models/HostAssignmentContext.cs b/src/WebJobs.Script.WebHost/Models/HostAssignmentContext.cs
@@ -110,6 +110,17 @@ public void ApplyAppSettings(IEnvironment environment)
             {
                 environment.SetEnvironmentVariable(pair.Key, pair.Value);
             }
+
+            if (CorsSettings != null)
+            {
+                environment.SetEnvironmentVariable(EnvironmentSettingNames.CorsSupportCredentials, CorsSettings.SupportCredentials.ToString());
+
+                if (CorsSettings.AllowedOrigins != null)
+                {
+                    var allowedOrigins = JsonConvert.SerializeObject(CorsSettings.AllowedOrigins);
+                    environment.SetEnvironmentVariable(EnvironmentSettingNames.CorsAllowedOrigins, allowedOrigins);
+                }
+            }
         }
     }
 }
diff --git a/src/WebJobs.Script.WebHost/WebScriptHostBuilderExtension.cs b/src/WebJobs.Script.WebHost/WebScriptHostBuilderExtension.cs
@@ -38,6 +38,8 @@ public static IHostBuilder AddWebScriptHost(this IHostBuilder builder, IServiceP
                     services.ConfigureOptions<HttpOptionsSetup>();
                     services.ConfigureOptions<CustomHttpHeadersOptionsSetup>();
                     services.ConfigureOptions<HostHstsOptionsSetup>();
+                    services.ConfigureOptions<HostCorsOptionsSetup>();
+                    services.ConfigureOptions<CorsOptionsSetup>();
                 })
                 .AddScriptHost(webHostOptions, configLoggerFactory, metricsLogger, webJobsBuilder =>
                 {
@@ -84,6 +86,12 @@ public static IHostBuilder AddWebScriptHost(this IHostBuilder builder, IServiceP
                     services.TryAddSingleton<IJobHostMiddlewarePipeline, DefaultMiddlewarePipeline>();
                     services.TryAddEnumerable(ServiceDescriptor.Singleton<IJobHostHttpMiddleware, CustomHttpHeadersMiddleware>());
                     services.TryAddEnumerable(ServiceDescriptor.Singleton<IJobHostHttpMiddleware, HstsConfigurationMiddleware>());
+                    if (environment.IsLinuxConsumption())
+                    {
+                        services.AddCors();
+                        services.AddSingleton<ICorsMiddlewareFactory, CorsMiddlewareFactory>();
+                        services.TryAddEnumerable(ServiceDescriptor.Singleton<IJobHostHttpMiddleware, CorsConfigurationMiddleware>());
+                    }
                     services.TryAddSingleton<IScaleMetricsRepository, TableStorageScaleMetricsRepository>();
 
                     // Make sure the registered IHostIdProvider is used
diff --git a/src/WebJobs.Script/Environment/EnvironmentSettingNames.cs b/src/WebJobs.Script/Environment/EnvironmentSettingNames.cs
@@ -82,5 +82,9 @@ public static class EnvironmentSettingNames
         public const string FunctionsSecretsPath = "FUNCTIONS_SECRETS_PATH";
         public const string FunctionsTestDataPath = "FUNCTIONS_TEST_DATA_PATH";
         public const string MeshInitURI = "MESH_INIT_URI";
+
+        // CORS settings
+        public const string CorsAllowedOrigins = "CORS_ALLOWED_ORIGINS";
+        public const string CorsSupportCredentials = "CORS_SUPPORT_CREDENTIALS";
     }
 }
diff --git a/src/WebJobs.Script/ScriptConstants.cs b/src/WebJobs.Script/ScriptConstants.cs
@@ -21,6 +21,7 @@ public static class ScriptConstants
         public const string AzureFunctionsDuplicateHttpHeadersKey = "MS_AzureFunctionsDuplicateHttpHeaders";
         public const string JobHostMiddlewarePipelineRequestDelegate = "MS_JobHostMiddlewarePipelineRequestDelegate";
         public const string HstsMiddlewareRequestDelegate = "MS_HstsMiddlewareRequestDelegate";
+        public const string CorsMiddlewareRequestDelegate = "MS_CorsMiddlewareRequestDelegate";
 
         public const string LegacyPlaceholderTemplateSiteName = "FunctionsPlaceholderTemplateSite";
 
diff --git a/test/WebJobs.Script.Tests.Integration/Management/InstanceManagerTests.cs b/test/WebJobs.Script.Tests.Integration/Management/InstanceManagerTests.cs
@@ -17,6 +17,7 @@
 using Microsoft.WebJobs.Script.Tests;
 using Moq;
 using Moq.Protected;
+using Newtonsoft.Json;
 using Xunit;
 
 namespace Microsoft.Azure.WebJobs.Script.Tests.Managment
@@ -58,14 +59,26 @@ public async Task StartAssignment_AppliesAssignmentContext()
                 Name = Path.GetTempFileName().Replace(".", string.Empty),
                 Value = Guid.NewGuid().ToString()
             };
+            var allowedOrigins = new string[]
+            {
+                "https://functions.azure.com",
+                "https://functions-staging.azure.com",
+                "https://functions-next.azure.com"
+            };
+            var supportCredentials = true;
 
             _environment.SetEnvironmentVariable(EnvironmentSettingNames.AzureWebsitePlaceholderMode, "1");
             var context = new HostAssignmentContext
             {
                 Environment = new Dictionary<string, string>
                 {
                     { envValue.Name, envValue.Value }
-                }
+                },
+                CorsSettings = new CorsSettings
+                {
+                    AllowedOrigins = allowedOrigins,
+                    SupportCredentials = supportCredentials,
+                },
             };
             bool result = _instanceManager.StartAssignment(context, isWarmup: false);
             Assert.True(result);
@@ -77,6 +90,12 @@ public async Task StartAssignment_AppliesAssignmentContext()
             var value = _environment.GetEnvironmentVariable(envValue.Name);
             Assert.Equal(value, envValue.Value);
 
+            var supportCredentialsValue = _environment.GetEnvironmentVariable(EnvironmentSettingNames.CorsSupportCredentials);
+            Assert.Equal(supportCredentialsValue, supportCredentials.ToString());
+
+            var allowedOriginsValue = _environment.GetEnvironmentVariable(EnvironmentSettingNames.CorsAllowedOrigins);
+            Assert.Equal(allowedOriginsValue, JsonConvert.SerializeObject(allowedOrigins));
+
             // verify logs
             var logs = _loggerProvider.GetAllLogMessages().Select(p => p.FormattedMessage).ToArray();
             Assert.Collection(logs,
diff --git a/test/WebJobs.Script.Tests/Middleware/CorsConfigurationMiddlewareTests.cs b/test/WebJobs.Script.Tests/Middleware/CorsConfigurationMiddlewareTests.cs

Original file line number	Diff line number	Diff line change
`@@ -110,6 +110,17 @@ public void ApplyAppSettings(IEnvironment environment)`
`110`	`110`	`{`
`111`	`111`	`environment.SetEnvironmentVariable(pair.Key, pair.Value);`
`112`	`112`	`}`
	`113`	`+`
	`114`	`+ if (CorsSettings != null)`
	`115`	`+ {`
	`116`	`+ environment.SetEnvironmentVariable(EnvironmentSettingNames.CorsSupportCredentials, CorsSettings.SupportCredentials.ToString());`
	`117`	`+`
	`118`	`+ if (CorsSettings.AllowedOrigins != null)`
	`119`	`+ {`
	`120`	`+ var allowedOrigins = JsonConvert.SerializeObject(CorsSettings.AllowedOrigins);`
	`121`	`+ environment.SetEnvironmentVariable(EnvironmentSettingNames.CorsAllowedOrigins, allowedOrigins);`
	`122`	`+ }`
	`123`	`+ }`
`113`	`124`	`}`
`114`	`125`	`}`
`115`	`126`	`}`
Original file line number	Diff line number	Diff line change
`@@ -82,5 +82,9 @@ public static class EnvironmentSettingNames`
`82`	`82`	`public const string FunctionsSecretsPath = "FUNCTIONS_SECRETS_PATH";`
`83`	`83`	`public const string FunctionsTestDataPath = "FUNCTIONS_TEST_DATA_PATH";`
`84`	`84`	`public const string MeshInitURI = "MESH_INIT_URI";`
	`85`	`+`
	`86`	`+ // CORS settings`
	`87`	`+ public const string CorsAllowedOrigins = "CORS_ALLOWED_ORIGINS";`
	`88`	`+ public const string CorsSupportCredentials = "CORS_SUPPORT_CREDENTIALS";`
`85`	`89`	`}`
`86`	`90`	`}`