Require the MSAspNetCoreToken or send a 400. #148
Conversation
| @@ -57,7 +57,7 @@ public IISMiddleware(RequestDelegate next, ILoggerFactory loggerFactory, IOption | |||
| if (!string.Equals(_pairingToken, httpContext.Request.Headers[MSAspNetCoreToken], StringComparison.Ordinal)) | |||
| { | |||
| _logger.LogTrace($"'{MSAspNetCoreToken}' does not match the expected pairing token '{_pairingToken}', skipping {nameof(IISMiddleware)}."); | |||
There was a problem hiding this comment.
IMHO, you should consider updating the log level of this message to error (or critical, since it would indicate that the request wasn't handled by IIS, which may be terribad in production).
Tratcher
force-pushed
the
tratcher/required
branch
from
e1fbc62
to
041698c
Compare
|
Updated the log level. |
Tratcher
force-pushed
the
tratcher/required
branch
from
041698c
to
53463e4
Compare
|
@Tratcher did you start an internal thread for RC2 approval? |
|
Yes he did |
|
👍 |
Tratcher
force-pushed
the
tratcher/required
branch
from
53463e4
to
fcdf8dd
Compare
|
I'm getting an error
Any ideas as to what I'm doing wrong? I'm deploying onto a windows service with IIS |
|
@superlogical can you log a new bug on this, including any info you have on which versions of ASP.NET Core and the ASP.NET Core Module you're using? |
|
That's very unexpected. This check is used to block requests that bypass IIS and are sent directly to the back-end process. Which port did you configure IIS on, and which port did you send the request to? What do you mean you're deploying IIS in a windows service? IIS runs as it's own service, not inside your own service. Or are you trying to use IIS Express? |
#141 @blowdart
@Eilon @DamianEdwards Please approve for RC2.