diff --git a/src/Umbraco.Infrastructure/Services/Implement/BasicAuthService.cs b/src/Umbraco.Infrastructure/Services/Implement/BasicAuthService.cs index a685e4baca..9e413b7162 100644 --- a/src/Umbraco.Infrastructure/Services/Implement/BasicAuthService.cs +++ b/src/Umbraco.Infrastructure/Services/Implement/BasicAuthService.cs @@ -21,10 +21,10 @@ namespace Umbraco.Cms.Core.Services.Implement { foreach (var allowedIpString in _basicAuthSettings.AllowedIPs) { - if(IPNetwork.TryParse(allowedIpString, out var allowedIp) && allowedIp.Contains(clientIpAddress)) + if (IPNetwork.TryParse(allowedIpString, out IPNetwork allowedIp) && allowedIp.Contains(clientIpAddress)) { return true; - }; + } } return false; diff --git a/src/Umbraco.Tests.UnitTests/Umbraco.Web.Common/Extensions/HttpContextExtensionTests.cs b/src/Umbraco.Tests.UnitTests/Umbraco.Web.Common/Extensions/HttpContextExtensionTests.cs new file mode 100644 index 0000000000..ba87c6b9c5 --- /dev/null +++ b/src/Umbraco.Tests.UnitTests/Umbraco.Web.Common/Extensions/HttpContextExtensionTests.cs @@ -0,0 +1,42 @@ +// Copyright (c) Umbraco. +// See LICENSE for more details. + +using System; +using System.Text; +using Microsoft.AspNetCore.Http; +using NUnit.Framework; +using Umbraco.Extensions; + +namespace Umbraco.Cms.Tests.UnitTests.Umbraco.Web.Common.Extensions +{ + [TestFixture] + public class HttpContextExtensionTests + { + [Test] + public void TryGetBasicAuthCredentials_WithoutHeader_ReturnsFalse() + { + var httpContext = new DefaultHttpContext(); + + var result = httpContext.TryGetBasicAuthCredentials(out string _, out string _); + + Assert.IsFalse(result); + } + + [Test] + public void TryGetBasicAuthCredentials_WithHeader_ReturnsTrueWithCredentials() + { + const string Username = "fred"; + const string Password = "test"; + + var httpContext = new DefaultHttpContext(); + var credentials = Convert.ToBase64String(Encoding.ASCII.GetBytes($"{Username}:{Password}")); + httpContext.Request.Headers.Add("Authorization", $"Basic {credentials}"); + + bool result = httpContext.TryGetBasicAuthCredentials(out string username, out string password); + + Assert.IsTrue(result); + Assert.AreEqual(Username, username); + Assert.AreEqual(Password, password); + } + } +} diff --git a/src/Umbraco.Web.Common/Extensions/HttpContextExtensions.cs b/src/Umbraco.Web.Common/Extensions/HttpContextExtensions.cs index afd0c5be48..d6beb90c01 100644 --- a/src/Umbraco.Web.Common/Extensions/HttpContextExtensions.cs +++ b/src/Umbraco.Web.Common/Extensions/HttpContextExtensions.cs @@ -5,13 +5,12 @@ using System.Threading.Tasks; using Microsoft.AspNetCore.Authentication; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Http.Features; +using Microsoft.Extensions.Primitives; namespace Umbraco.Extensions { public static class HttpContextExtensions { - - /// /// Try to get the basic auth username and password from the http context. /// @@ -20,14 +19,14 @@ namespace Umbraco.Extensions username = null; password = null; - if ( httpContext.Request.Headers.TryGetValue("Authorization", out var authHeaders)) + if (httpContext.Request.Headers.TryGetValue("Authorization", out StringValues authHeaders)) { var authHeader = authHeaders.ToString(); if (authHeader is not null && authHeader.StartsWith("Basic")) { - //Extract credentials + // Extract credentials. var encodedUsernamePassword = authHeader.Substring(6).Trim(); - var encoding = Encoding.UTF8; + Encoding encoding = Encoding.UTF8; var usernamePassword = encoding.GetString(Convert.FromBase64String(encodedUsernamePassword)); var seperatorIndex = usernamePassword.IndexOf(':'); diff --git a/src/Umbraco.Web.Website/Middleware/BasicAuthenticationMiddleware.cs b/src/Umbraco.Web.Website/Middleware/BasicAuthenticationMiddleware.cs index 7766867991..be2ee24d4f 100644 --- a/src/Umbraco.Web.Website/Middleware/BasicAuthenticationMiddleware.cs +++ b/src/Umbraco.Web.Website/Middleware/BasicAuthenticationMiddleware.cs @@ -1,3 +1,4 @@ +using System.Net; using System.Threading.Tasks; using Microsoft.AspNetCore.Authentication; using Microsoft.AspNetCore.Http; @@ -35,7 +36,7 @@ namespace Umbraco.Cms.Web.Common.Middleware return; } - var clientIPAddress = context.Connection.RemoteIpAddress; + IPAddress clientIPAddress = context.Connection.RemoteIpAddress; if (_basicAuthService.IsIpAllowListed(clientIPAddress)) { await next(context);