Bug/options #130
Bug/options #130
Conversation
We want to skip the auth check for OPTION requests that are sent. These are just to test capabilities for CORS and do not do anything that is relevant to authentication. closes #40
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| /// <returns>The user and their roles if successful, <see cref="AuthenticateResult.Fail(string)" /> otherwise.</returns> | ||
| protected override async Task<AuthenticateResult> HandleAuthenticateAsync() { | ||
| // Skip options requests | ||
| if (Request.Method == "OPTIONS") { |
Check failure
Code scanning / CodeQL
User-controlled bypass of sensitive method High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 2 months ago
To reduce the risk of user-controlled bypass of authentication, we need to remove or properly handle the condition that allows OPTIONS requests to skip authentication. The best practice is to handle OPTIONS requests at a different (earlier) layer, outside of the authentication handler—for example, by middleware that handles OPTIONS/CORS specifically, or by configuring endpoint authorization policies. If OPTIONS requests genuinely should always pass through unauthenticated, this should be enforced globally and securely. Otherwise, a malicious user can simply send OPTIONS requests to protected endpoints.
Steps:
- In
BasicAuthenticationHandler.cs, withinHandleAuthenticateAsync, remove the check forRequest.Method == "OPTIONS". - If OPTIONS requests must be handled differently, this should be set up elsewhere (such as globally allowing OPTIONS to bypass authentication using ASP.NET Core middleware or endpoint configuration).
- No additional methods, imports, or definitions are required for this change.
| @@ -45,11 +45,6 @@ | ||
| /// </summary> | ||
| /// <returns>The user and their roles if successful, <see cref="AuthenticateResult.Fail(string)" /> otherwise.</returns> | ||
| protected override async Task<AuthenticateResult> HandleAuthenticateAsync() { | ||
| // Skip options requests | ||
| if (Request.Method == "OPTIONS") { | ||
| return AuthenticateResult.NoResult(); | ||
| } | ||
|
|
||
| // Read token from HTTP request header | ||
| string? authorizationHeader = Request.Headers.Authorization; | ||
| if (string.IsNullOrEmpty(authorizationHeader) || !authorizationHeader.StartsWith("Bearer ")) { |
We want to skip the auth check for OPTION requests that are sent. These
are just to test capabilities for CORS and do not do anything that is
relevant to authentication.
closes #40