#141 Require the MSAspNetCoreToken or send a 400.

aspnet · Apr 22, 2016 · 53463e4 · 53463e4
1 parent f129324
commit 53463e4
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 6 deletions.
diff --git a/src/Microsoft.AspNetCore.Server.IISIntegration/IISMiddleware.cs b/src/Microsoft.AspNetCore.Server.IISIntegration/IISMiddleware.cs
@@ -56,8 +56,8 @@ public async Task Invoke(HttpContext httpContext)
         {
             if (!string.Equals(_pairingToken, httpContext.Request.Headers[MSAspNetCoreToken], StringComparison.Ordinal))
             {
-                _logger.LogTrace($"'{MSAspNetCoreToken}' does not match the expected pairing token '{_pairingToken}', skipping {nameof(IISMiddleware)}.");
-                await _next(httpContext);
+                _logger.LogError($"'{MSAspNetCoreToken}' does not match the expected pairing token '{_pairingToken}', request rejected.");
+                httpContext.Response.StatusCode = 400;
                 return;
             }
 

diff --git a/test/Microsoft.AspNetCore.Server.IISIntegration.Tests/IISMiddlewareTests.cs b/test/Microsoft.AspNetCore.Server.IISIntegration.Tests/IISMiddlewareTests.cs
@@ -2,6 +2,7 @@
 // Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
 
 using System;
+using System.Net;
 using System.Net.Http;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Builder;
@@ -38,12 +39,13 @@ public async Task MiddlewareSkippedIfTokenIsMissing()
 
             var req = new HttpRequestMessage(HttpMethod.Get, "");
             req.Headers.TryAddWithoutValidation("MS-ASPNETCORE-TOKEN", "TestToken");
-            await server.CreateClient().SendAsync(req);
+            var response = await server.CreateClient().SendAsync(req);
             Assert.True(assertsExecuted);
+            response.EnsureSuccessStatusCode();
         }
 
         [Fact]
-        public async Task MiddlewareSkippedIfTokenHeaderIsMissing()
+        public async Task MiddlewareRejectsRequestIfTokenHeaderIsMissing()
         {
             var assertsExecuted = false;
 
@@ -65,8 +67,9 @@ public async Task MiddlewareSkippedIfTokenHeaderIsMissing()
             var server = new TestServer(builder);
 
             var req = new HttpRequestMessage(HttpMethod.Get, "");
-            await server.CreateClient().SendAsync(req);
-            Assert.True(assertsExecuted);
+            var response = await server.CreateClient().SendAsync(req);
+            Assert.False(assertsExecuted);
+            Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
         }
 
         [Fact]