Table of Contents

Namespace SEBT.Portal.Api.Middleware

Classes

OidcOriginValidationMiddleware

validates the Origin header on OIDC auth POST endpoints. Browsers set Origin automatically on same-origin fetch POSTs; a missing or mismatched header indicates cross-origin replay or a non-browser client that we don't expect on these endpoints.

Policy:

  • POST to /api/auth/oidc/* → require Origin matches the configured portal origin. Reject with 403 if mismatched.
  • GET (config) → skip (idempotent, returns public info).
  • Referer is logged when mismatched but not enforced (privacy extensions strip it).
OtpRateLimitMiddleware

Middleware that extracts the email address from the OTP request body and stores it in HttpContext.Items for use by rate limiting partition key resolver.