Class OidcOriginValidationMiddleware

Namespace

SEBT.Portal.Api.Middleware

Assembly

SEBT.Portal.Api.dll

validates the Origin header on OIDC auth POST endpoints. Browsers set Origin automatically on same-origin fetch POSTs; a missing or mismatched header indicates cross-origin replay or a non-browser client that we don't expect on these endpoints.

Policy:

• POST to /api/auth/oidc/* → require Origin matches the configured portal origin. Reject with 403 if mismatched.
• GET (config) → skip (idempotent, returns public info).
• Referer is logged when mismatched but not enforced (privacy extensions strip it).

public class OidcOriginValidationMiddleware

Inheritance

object

OidcOriginValidationMiddleware

Constructors

OidcOriginValidationMiddleware(RequestDelegate, ILogger<OidcOriginValidationMiddleware>, IOptions<OidcSettings>, IOptions<OidcStepUpSettings>)

Builds allowed-origin set from configured Oidc:CallbackRedirectUri.

public OidcOriginValidationMiddleware(RequestDelegate next, ILogger<OidcOriginValidationMiddleware> logger, IOptions<OidcSettings> oidcSettings, IOptions<OidcStepUpSettings> stepUpSettings)

Parameters

next RequestDelegate

logger ILogger<OidcOriginValidationMiddleware>

oidcSettings IOptions<OidcSettings>

stepUpSettings IOptions<OidcStepUpSettings>

Methods

InvokeAsync(HttpContext)

Validates Origin on OIDC POST requests; passes all others through.

public Task InvokeAsync(HttpContext context)

Parameters

context HttpContext

Returns

Task