How is configuration data protected in ASP .NET 5? - asp.net-core

Rather than requiring Web.config, ASP .NET 5 provides a number of options to provide configuration data. Info on this can be found at:
Introducing ASP .NET 5 by Scott Guthrie
How can we store configuration data in new asp.net vnext? (StackOverflow)
ASP.NET vNext Moving Parts: IConfiguration by Louis DeJardin
There's an interesting question in the comments section of ScottGu's article:
The config.json file in the example, how is that protected by the webserver/http server? web.config is protected by IIS, but if any file can be used (which is great), it also comes with the burden that the webserver shouldn't serve the file out if one requests it in a URL. Or are there prefab names to choose from?
Can anyone answer this?

In previous versions of ASP.NET root of the project was also a root for the website. Some mechanisms were created to prevent access to files which should not be accessible to the outside world (like a whitelist of mime types, RequestFilteringModule).
This changed in ASP.NET 5 as a website root is no longer a project root.
Website root folder is a subfolder in your project directory (named wwwroot by default, but can be changed in project.json).
This means that everything outside a website root folder is not accessible to the outside world.
config.json file is outside of wwwroot so it won't be ever handled by any requests.

Related

What is the ASP.NET Core convention for static, non-MVC pages?

I'm converting my website from Web Forms to .NET Core. I don't want to change the directory level of various files, e.g.:
MYDOMAIN.com/FAQ.html
MYDOMAIN.com/Privacy.html
By using the UseStaticFiles() middleware, I can place these in the wwwroot folder and they will be served as is. However, I don't know how to apply a Layout page with my website theme to those files since they're outside of the MVC framework.
I'd like to leverage the Layout files and MVC framework by using .cshtml files, but I'm also trying to avoid the extra controller directory that's imposed on the URL:
MYDOMAIN.com/home/FAQ.html
MYDOMAIN.com/home/Privacy.html
Maybe this is short-sighted, but how do developers handle this?
And actually, my existing files are .aspx at the moment, not .html files so that adds another level of confusion as to what the convention is for migrating to .Net Core. Should I use any .aspx files anywhere in the project or should they all be converted to .cshtml / .html files? Or something else?
I have successfully implemented a solution, but it's kind of a hack. I add controllers for each static page, for example I created both a FAQController.cs and PrivacyController.cs.
Each controller has only Index() actions so that they can take advantage of _Layout.cshtml and _ViewStart.cshtml.
It seems like a roundabout way to go just to move the following up one level e.g.
MYDOMAIN.com/FAQ
MYDOMAIN.com/Privacy
but it works.

How to host Blazon in Razor Pages application

The "standard" Blazor WASM application is hosted inside a static HTML page; e.g., index.html. Due to certain requirements, I want to host Blazor inside a Razor pages application.
What I did is starting from a "standard" Blazor WASM application, removed the static files, because I do not need them, moved the content of index.html to the Wasm.cshtml, and change endpoints.MapFallbackToFile("index.html"); to endpoints.MapFallbackToPage("/Wasm");.
Everything seemed to be working as expected; I can run the application and navigate to the different pages I have in Blazor.
However, things fall apart when I try to access a page using its URL; e.g., http://mysite/counter, where /counter is a page in Blazor, and I get the following error:
An unhandled exception occurred while processing the request.
AmbiguousMatchException: The request matched multiple endpoints. Matches:
/Wasm
/Wasm
Can someone help me identify what I am doing wrong?
P.S.:
I looked at some answer here, but all that I found is people talking about Blazor Server.
I am using .NET 3.1 and Blazor 3.2.
I want to use my Razor Pages application to host/serve Blazor WASM not mixing them in a single project. They as still 2 different projects.
I am totally aware that Blazor WASM and Razor Pages are unrelated technologies. I am not trying to integrate them. I am only trying to server Blazor WASM files from a dynamic page. If it makes you think better about what I am trying to achieve, think about Razor Pages as any server-side technology; PHP, Node, or whatever, then apply this to the routing issue that I am trying to resolve.
OK, based on what you've written so far take a look at ShaunCurtis/Blazor-Experimental on Github. It's a temporary Repo for some experimental code. Ignore BlazorTest. The startup project is Blazor-Experimental.
The default page is a normal razor page. It's a mixed Razor, Blazor Server and Blazor WASM site. All the WASM routes look like wasm/fetchdata, so we have different URLs for all the Server and WASM "Pages".
Startup differentiates URLs using multiple endpoints, so any URL that is in the "scope" of the Blazor WASM application gets set to _wasm.cshtml. Anything else that can't be mapped directly is in the "scope" of the Blazor Server Application at _host.cshtml. All plan Razor pages on the site get served as is. You don't need the Blazor Server bit at all, just fallback to the default Razor page.
endpoints.MapFallbackToPage("/wasm/{**segment}", "/_wasm");
endpoints.MapFallbackToPage("/_Host");
To summarise the answer:
Create a Blazor WASM project. You can copy the one from Blazor Hosted template.
Reference the project from the Razor Pages project.
Create the page that will host Blazor WASM; e.g., Wasm.cshtml, and make sure the page route is not set; i.e., only #page at the top of the page, so that it takes the default route /wasm.
Copy the code from index.html in the Blazor WASM project into Wasm.cshtml.
Important: If you are using your own layout, it is important to have <base href="/" /> on the page or the layout <head> section.
Remove all the static files from form the Blazor WASM project; e.g., index.html.
Remove all *.razor pages from the Blazor WASM project.
Add Wasm.razor to the Blazor WASM project and set its route to /wasm; i.e., #page "/wasm".
In Startup.cs in the Razor Pages project, add app.UseBlazorFrameworkFiles(); after app.UseStaticFiles();.
Also in the same Startup.cs, add endpoints.MapFallbackToPage("/wasm/{**segment}", "/wasm"); inside app.UseEndpoints() lambda.
Now run the application and navigate to /wasm. You should see the content of your Wasm.razor in addition to whatever layout you have set. You will get the same result when you paste the URL http://whateveryoursiteis/wasm.
You give very little information, so I'll have to make a number of guesses.
I guess you based your WASM integration on the Blazor WASM ASP.NET hosted template. That template consists of three projects: The .Client project, the .Server project and some extra project with shared models (they're probably doing clean architecture). The server project is a Razor pages project and the client a WASM project.
What you must understand is that a Blazor WASM project is not comparable with a Razor pages application. A Blazor WASM, or actually any WASM file is a different kind of binary and is fully run at the client! It is a client-side application. I.e. the output binary is totally different. You cannot have one project that generates both a server (x86/arm) binary and a client (WASM) binary. You need two separate projects.
What actually happens while compiling the WASM project, is that all page routing is also converted to WASM. Just inspect your network traffic when you change a page. Even though you browser url changes, that's fake... there is no network traffic! In fact, you stay on the same page.
Now think what happens when you enter "[..]/counter" manually in the browser. The host will actually again download the same .wasm file from the root ("/" = "/Index") and then parse the routing client-side.
Going back to your problem. For some reason you copied all the contents from the Blazer WASM project wwwroot/index.html to a Razor Page project Pages/Index.cshtml. Now you're confusing the whole routing system. When you type "[...]/counter", the WASM router will tell you that the .wasm file needs to be downloaded from "/Index". At the same time the Razor Pages router will tell you the compiled Index.cshtml is available at "/Index". That will give your "AmbiguousMatchException: The request matched multiple endpoints. Matches: /Index /Index".
Just look at the Summary of UseBlazorFrameworkFiles:
Configures the application to serve Blazor WebAssembly framework files from the root path "/".
Solution is just to keep the index.html in the WASM project as is. Just look at the default Blazor WASM ASP.Net app: it hosts Blazor WASM, Razor Pages and MVC at the same time and routing is just fine.
A different solution would be to use the overload of UseBlazorFrameworkFiles, where you can give a path prefix. E.g.
app.UseBlazorFrameworkFiles("/wasm");
You will need to fix other routing.
edit:
So let's give a case. you have:
A Blazor WASM project that serves pages /, /counter, etc.
A Razor pages project that serves pages /weatherforecast, etc.
Now:
you start the app on /. This loads the WASM from the server.
Next you click on the counter icon. this doesn't change the page!: it shows the counter page and updates the navigation url, but doensn't load a new page.
Now to go to weatherforecast. This is not found in the WASM, so a new page is actually loaded from the server. (either a razor page or controller/view)
If you would go back to counter, this is not found on the server, so the server 'falls-back' to the root (/Index) and loads the WASM again. Next is look if counter is found in the WASM.
Having a dynamic /Index will disrupt this system, so you'll have to manually solve all the routing.

Let's Encrypt with ASP.Net Core and Azure App Service

I have a Runbook in Azure that uses AcmeSharp to generate Let's Encrypt certificates for a website running in Azure App Services. I have used it many times successfully on many ASP.Net sites. Apparently I've never tried it on an ASP.Net Core (2.2) site until now.
I'm pretty sure I was running into the problem described in this blog post - https://ronaldwildenberg.com/letsencrypt-for-asp-net-core-on-azure. Basically, the script publishes a static file to /.wellknown/acme-challenge/randomstring/index.html in my site and then Let's Encrypt tries to verify that file. I'm getting a 404 when trying to hit this URL even though I can see it in the file system in Kudu.
I felt like this was a static file issue in ASP.Net Core and when I found the blog post referred to above - I thought that was going to be the answer. I changed my code as prescribed in the article, but I'm still getting the 404.
Slightly different than the article, instead of files with long random strings of characters like in the article screenshot, my script generates a string like that but creates a folder with that name. Inside each folder is one file (named index.html) that contains the validation info Let's Encrypt is looking for. You can see this at http://www.technicality.online/.well-known/acme-challenge/
You can see the folders are browsable and if you click one, you can see the link to index.html. The problem is - if you click index.html, you get a 404. I've put this in my Startup.Configure:
var rootPath = Path.GetFullPath(".");
var acmeChallengePath =
Path.Combine(rootPath, #".well-known\acme-challenge");
app.UseDirectoryBrowser(new DirectoryBrowserOptions
{
FileProvider = new PhysicalFileProvider(acmeChallengePath),
RequestPath = new PathString("/.well-known/acme-challenge"),
});
app.UseStaticFiles(new StaticFileOptions
{
ServeUnknownFileTypes = true
});
(I don't think I need the ServeUnknownFileTypes since my file is index.html, as opposed to the long random string in the blog post, but I don't think this should hurt anything either.)
I thought maybe the issue was that the file didn't contain valid html (just a string of characters), but I put another file that did contain valid html and I get a 404 when clicking that one as well.
Is there some other ASP.Net Core (or Azure App Service) detail I'm missing to make the application serve up the index.html files?
I figured this out and am posting the answer to hopefully keep someone else from making the same mistake I did. The issue wasn't at all what I thought it was, but rather - there are two "wwwroot" folders in an ASP.Net Core Azure App Service hosting environment and I wasn't paying close enough attention.
The file system path where Azure hosts your application is D:\home\site\wwwroot. In a "classic" ASP.Net scenario, your static files go in that folder. In an ASP.Net Core scenario, another wwwroot folder is created underneath that one. My script (written for ASP.Net) was creating the ".well-known\acme-challenge" folder beneath the first one. The standard app.UseStaticFiles() doesn't help with those.
Basically, I had:
-home
--site
---wwwroot (hosting root)
----wwwroot (ASP.Net core static files folder)
----.well-known (this was a sibling of the 2nd wwwroot and needed to be a child)
I needed to change my script to put my static files under the 2nd wwwroot so that the app.UseStaticFiles() would serve those files.

How to find the logical path to application in startup.cs

In Startup.cs configure method when setting cookie authentication options the login path in the examples seem to reference a web root path.
https://docs.asp.net/en/latest/security/authentication/cookie.html
What if I am deploying the app in a virtual directory and do not want to hardcode it?
I could add the virtual directory to a config file but it seems like a step backwords. When I had similar issues before it seemed like i could use Url.Action or the VirtualPathUtility. Is there something similar in asp.net core that can be used in startup.cs?

VirtualPathProvider on IIS 6 does not handle file stream caching correctly

I am working on a framework where .aspx and .master pages are embedded in an assembly, using VirtualPathProvider to route a url to a specific embedded resource.
Sample url: /_framework.aspx/mypage.aspx (which uses /_framework.aspx/mymaster.master)
_framework.aspx will make IIS6 route the request through ASP.NET framework
everything after the .aspx is treated as a PathInfo in the .NET framework
In Visual Studio 2008 web server, the virtualPath is correctly: /_framework.aspx/mypage.aspx
but in IIS6 the virtualPath is: /_framework.aspx
If I request two files: /_framework.aspx/file1.css and /_framework.aspx/file2.css
the file2 will have the same content as file1.
I suspect that IIS6 considers the file path (_framework.aspx) and caches the file stream which is returned from the assembly, thus treating both urls as the same file.
Temporary solution:
I've implemented a CacheDependency class like this
class ImmediateExpiryCacheDependency : System.Web.Caching.CacheDependency
{
public ImmediateExpiryCacheDependency()
{
base.NotifyDependencyChanged(null, null);
}
}
It now expires the file stream cache, but doens't work with master pages, I guess because it is requested before the cache is expired through NotifyDependencyChanged.
Needed solution:
If I returned null in GetCacheDependency, IIS6 doesn't expire the file immediately. What is the correct way to immediately expire a file or disable the caching entirely. Even better, I would like to correct the way that IIS6 deals with the url, since the caching is actually good, if it would use the full file url.
Through my work in the ASP.NET Development Web Server, I had come to conclude that the correct FilePath would include the PathInfo, but I understand now that the IIS implementation is correct.
I changed my code so that ASP.NET files (aspx, ashx) would have a path such as /_framework/Default.aspx (since these files will be routed without special configuration) with a master page path such as /_framework/Site.master (since this is routed internally in the ASP.NET engine) and with image resources with a path /_framework.ashx/image.gif (since the .ashx will be routed to the ASP.NET engine, from where I will then use a kind of StaticFileHandler).
This way, all pages and resources can reside and remain entirely in the assembly :-)