Avoid cookie login redirects for known API endpoints #62816
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
There was a problem hiding this comment.
Pull Request Overview
This PR introduces IApiEndpointMetadata as a new public interface to identify API endpoints that should avoid cookie authentication redirects in favor of status codes. The interface is automatically added to endpoints that expect JSON request bodies or return JSON responses, signaling they are programmatic APIs rather than browser-navigated endpoints.
Key changes:
- Adds
IApiEndpointMetadatainterface and internal implementation - Modifies cookie authentication to check for this metadata and return 401/403 status codes instead of redirects
- Updates HTTP Results types and request delegate generation to automatically add the metadata
Reviewed Changes
Copilot reviewed 107 out of 108 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
src/Http/Http.Abstractions/src/Metadata/IApiEndpointMetadata.cs |
Defines the new public interface for API endpoint identification |
src/Security/Authentication/Cookies/src/CookieAuthenticationEvents.cs |
Updates authentication logic to check for API endpoints and return status codes |
src/Mvc/Mvc.Core/src/ApiControllerAttribute.cs |
Makes ApiControllerAttribute implement IApiEndpointMetadata |
| Multiple HTTP Results files | Adds IApiEndpointMetadata to various result types' PopulateMetadata methods |
| Request delegate generator files | Updates code generation to automatically add API metadata |
Comments suppressed due to low confidence (1)
src/Security/Authentication/test/CookieTests.cs:130
- The comment references 'INonBrowserEndpointMetadata' but the code adds 'ApiEndpointMetadata.Instance'. The comment should be updated to reflect the actual metadata being added.
var transaction = await SendAsync(server, "http://example.com/protected/CustomRedirect");
| namespace Microsoft.AspNetCore.Http.Metadata; | ||
|
|
||
| /// <summary> | ||
| /// Metadata that indicates the endpoint is an API intended for programatic access rather than direct browser navigation. |
There was a problem hiding this comment.
The word 'programatic' should be spelled 'programmatic'.
Suggested change
| /// Metadata that indicates the endpoint is an API intended for programatic access rather than direct browser navigation. | |
| /// Metadata that indicates the endpoint is an API intended for programmatic access rather than direct browser navigation. |
Copilot uses AI. Check for mistakes.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This adds IApiEndpointMetadata as new public API. It doesn't add any attributes or extension methods, but we do add it automatically if RDF/RDG read a JSON request body or write a JSON response body. ApiController endpoints, SignalR endpoints and endpoints with TypedResults return-types that we know to be API-oriented also get this metadata automatically.
I plan to open an API proposal issue shortly to discuss this, and what IResult types (or other types or methods for that matter) should add this metadata.
Fixes #9039