Skip to content

Fix: TerminateUnmatchedRequest should be bool? in Cors policy #182

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
drjonnicholson wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Fix: TerminateUnmatchedRequest should be bool? in Cors policy #182

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6d34e49
Change cors policy TerminateUnmatchedRequest type to bool
drjonnicholson Nov 21, 2025
9d89325
Add tests
drjonnicholson Nov 21, 2025
0e489f3
Merge remote-tracking branch 'upstream/main' into bugfix-cors-policy
drjonnicholson Dec 30, 2025
1c022d5
Add expression tests so some properties
drjonnicholson Dec 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/Authoring/Configs/CorsConfig.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ public record CorsConfig
/// Policy expressions are allowed.
/// </summary>
[ExpressionAllowed]
public string? TerminateUnmatchedRequest { get; init; }
public bool? TerminateUnmatchedRequest { get; init; }

/// <summary>
/// List of origins allowed to make cross-origin calls to your API.<br/>
Expand Down
229 changes: 196 additions & 33 deletions test/Test.Core/Compiling/CorsTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,10 @@ public class PolicyDocument : IDocument
{
public void Inbound(IInboundContext context) {
context.Cors(new CorsConfig()
{
AllowedOrigins = ["contoso.com"],
AllowedHeaders = ["accept"],
});
{
AllowedOrigins = ["contoso.com"],
AllowedHeaders = ["accept"],
});
}
}
""",
Expand All @@ -44,10 +44,10 @@ public class PolicyDocument : IDocument
{
public void Inbound(IInboundContext context) {
context.Cors(new CorsConfig()
{
AllowedOrigins = ["contoso.com", "fabrikam.com"],
AllowedHeaders = ["accept"],
});
{
AllowedOrigins = ["contoso.com", "fabrikam.com"],
AllowedHeaders = ["accept"],
});
}
}
""",
Expand All @@ -67,6 +67,37 @@ public void Inbound(IInboundContext context) {
</policies>
""",
DisplayName = "Should compile cors policy with multiple origins"
)]
[DataRow(
"""
[Document]
public class PolicyDocument : IDocument
{
public void Inbound(IInboundContext context) {
context.Cors(new CorsConfig()
{
AllowedOrigins = [GetCorsOrigin(context.ExpressionContext)],
AllowedHeaders = ["accept"],
});
}
string GetCorsOrigin(IExpressionContext context) => (string)context.Variables["CorsOrigin"];
}
""",
"""
<policies>
<inbound>
<cors>
<allowed-origins>
<origin>@((string)context.Variables["CorsOrigin"])</origin>
</allowed-origins>
<allowed-headers>
<header>accept</header>
</allowed-headers>
</cors>
</inbound>
</policies>
""",
DisplayName = "Should allow origin from an expression"
)]
[DataRow(
"""
Expand All @@ -75,10 +106,10 @@ public class PolicyDocument : IDocument
{
public void Inbound(IInboundContext context) {
context.Cors(new CorsConfig()
{
AllowedOrigins = ["contoso.com"],
AllowedHeaders = ["accept", "content-type"],
});
{
AllowedOrigins = ["contoso.com"],
AllowedHeaders = ["accept", "content-type"],
});
}
}
""",
Expand Down Expand Up @@ -106,11 +137,11 @@ public class PolicyDocument : IDocument
{
public void Inbound(IInboundContext context) {
context.Cors(new CorsConfig()
{
AllowCredentials = true,
AllowedOrigins = ["contoso.com"],
AllowedHeaders = ["accept"],
});
{
AllowCredentials = true,
AllowedOrigins = ["contoso.com"],
AllowedHeaders = ["accept"],
});
}
}
""",
Expand All @@ -137,11 +168,11 @@ public class PolicyDocument : IDocument
{
public void Inbound(IInboundContext context) {
context.Cors(new CorsConfig()
{
AllowedOrigins = ["contoso.com"],
AllowedHeaders = ["accept"],
AllowedMethods = ["PUT", "DELETE"],
});
{
AllowedOrigins = ["contoso.com"],
AllowedHeaders = ["accept"],
AllowedMethods = ["PUT", "DELETE"],
});
}
}
""",
Expand Down Expand Up @@ -172,12 +203,12 @@ public class PolicyDocument : IDocument
{
public void Inbound(IInboundContext context) {
context.Cors(new CorsConfig()
{
AllowedOrigins = ["contoso.com"],
AllowedHeaders = ["accept"],
AllowedMethods = ["PUT", "DELETE"],
PreflightResultMaxAge = 100,
});
{
AllowedOrigins = ["contoso.com"],
AllowedHeaders = ["accept"],
AllowedMethods = ["PUT", "DELETE"],
PreflightResultMaxAge = 100,
});
}
}
""",
Expand All @@ -200,6 +231,44 @@ public void Inbound(IInboundContext context) {
</policies>
""",
DisplayName = "Should compile cors policy with allow methods and preflight result max age"
)]
[DataRow(
"""
[Document]
public class PolicyDocument : IDocument
{
public void Inbound(IInboundContext context) {
context.Cors(new CorsConfig()
{
AllowedOrigins = ["contoso.com"],
AllowedHeaders = ["accept"],
AllowedMethods = ["PUT", "DELETE"],
PreflightResultMaxAge = 100,
PreflightResultMaxAge = GetPreflightResultMaxAge(context.ExpressionContext),
});
}
int GetPreflightResultMaxAge(IExpressionContext context) => (int)context.Variables["PreflightResultMaxAge"];
}
""",
"""
<policies>
<inbound>
<cors>
<allowed-origins>
<origin>contoso.com</origin>
</allowed-origins>
<allowed-headers>
<header>accept</header>
</allowed-headers>
<allowed-methods preflight-result-max-age="@((int)context.Variables["PreflightResultMaxAge"])">
<method>PUT</method>
<method>DELETE</method>
</allowed-methods>
</cors>
</inbound>
</policies>
""",
DisplayName = "Should compile cors policy with allow methods and preflight result max age from expression"
)]
[DataRow(
"""
Expand All @@ -208,11 +277,11 @@ public class PolicyDocument : IDocument
{
public void Inbound(IInboundContext context) {
context.Cors(new CorsConfig()
{
AllowedOrigins = ["contoso.com"],
AllowedHeaders = ["accept"],
ExposeHeaders = ["accept", "content-type"],
});
{
AllowedOrigins = ["contoso.com"],
AllowedHeaders = ["accept"],
ExposeHeaders = ["accept", "content-type"],
});
}
}
""",
Expand All @@ -236,6 +305,100 @@ public void Inbound(IInboundContext context) {
""",
DisplayName = "Should compile cors policy with expose headers"
)]
[DataRow(
"""
[Document]
public class PolicyDocument : IDocument
{
public void Inbound(IInboundContext context) {
context.Cors(new CorsConfig()
{
AllowedOrigins = ["contoso.com"],
AllowedHeaders = ["accept"],
TerminateUnmatchedRequest = true,
});
}
}
""",
"""
<policies>
<inbound>
<cors terminate-unmatched-request="true">
<allowed-origins>
<origin>contoso.com</origin>
</allowed-origins>
<allowed-headers>
<header>accept</header>
</allowed-headers>
</cors>
</inbound>
</policies>
""",
DisplayName = "Should compile cors policy with terminate unmatched request explicitly enabled"
)]
[DataRow(
"""
[Document]
public class PolicyDocument : IDocument
{
public void Inbound(IInboundContext context) {
context.Cors(new CorsConfig()
{
AllowedOrigins = ["contoso.com"],
AllowedHeaders = ["accept"],
TerminateUnmatchedRequest = false,
});
}
}
""",
"""
<policies>
<inbound>
<cors terminate-unmatched-request="false">
<allowed-origins>
<origin>contoso.com</origin>
</allowed-origins>
<allowed-headers>
<header>accept</header>
</allowed-headers>
</cors>
</inbound>
</policies>
""",
DisplayName = "Should compile cors policy with terminate unmatched request disabled"
)]
[DataRow(
"""
[Document]
public class PolicyDocument : IDocument
{
public void Inbound(IInboundContext context) {
context.Cors(new CorsConfig()
{
AllowedOrigins = ["contoso.com"],
AllowedHeaders = ["accept"],
TerminateUnmatchedRequest = GetTerminateUnmatchedRequest(context.ExpressionContext),
});
}
bool GetTerminateUnmatchedRequest(IExpressionContext context) => (bool)context.Variables["TerminateUnmatchedRequest"];
}
""",
"""
<policies>
<inbound>
<cors terminate-unmatched-request="@((bool)context.Variables["TerminateUnmatchedRequest"])">
<allowed-origins>
<origin>contoso.com</origin>
</allowed-origins>
<allowed-headers>
<header>accept</header>
</allowed-headers>
</cors>
</inbound>
</policies>
""",
DisplayName = "Should compile cors policy with terminate unmatched request from expression"
)]
public void ShouldCompileCorsPolicy(string code, string expectedXml)
{
code.CompileDocument().Should().BeSuccessful().And.DocumentEquivalentTo(expectedXml);
Expand Down
Loading