Update the authentication handler to validate the HTTP method before the antiforgery token

Author: kevinchalet

src/AspNet.Security.OpenId/OpenIdAuthenticationHandler.cs

@@ -42,6 +42,15 @@ public OpenIdAuthenticationHandler(
 
         protected override async Task<HandleRequestResult> HandleRemoteAuthenticateAsync()
         {
+            // OpenID 2.0 responses MUST necessarily be made using either GET or POST.
+            // See http://openid.net/specs/openid-authentication-2_0.html#anchor4
+            if (!string.Equals(Request.Method, "GET", StringComparison.OrdinalIgnoreCase) &&
+                !string.Equals(Request.Method, "POST", StringComparison.OrdinalIgnoreCase))
+            {
+                return HandleRequestResult.Fail("The authentication response was rejected because it was made " +
+                                                "using an invalid method: make sure to use either GET or POST.");
+            }
+
             // Always extract the "state" parameter from the query string.
             var state = Request.Query[OpenIdAuthenticationConstants.Parameters.State];
             if (string.IsNullOrEmpty(state))
@@ -66,15 +75,6 @@ protected override async Task<HandleRequestResult> HandleRemoteAuthenticateAsync
 
             OpenIdAuthenticationMessage message;
 
-            // OpenID 2.0 responses MUST necessarily be made using either GET or POST.
-            // See http://openid.net/specs/openid-authentication-2_0.html#anchor4
-            if (!string.Equals(Request.Method, "GET", StringComparison.OrdinalIgnoreCase) &&
-                !string.Equals(Request.Method, "POST", StringComparison.OrdinalIgnoreCase))
-            {
-                return HandleRequestResult.Fail("The authentication response was rejected because it was made " +
-                                                "using an invalid method: make sure to use either GET or POST.");
-            }
-
             if (string.Equals(Request.Method, "GET", StringComparison.OrdinalIgnoreCase))
             {
                 message = new OpenIdAuthenticationMessage(Request.Query);