Skip to content

Legacy cookie gate middleware

This operation describes the shared behavior of LegacyBolAuthMiddleware and AspNetSessionIdMiddleware: both check for the presence of a legacy cookie and redirect to a configured legacy session endpoint if it is missing, but — critically — both always invoke the rest of the pipeline regardless of the outcome (see BR-SE-16 and security-authorization.md for the associated security weakness, findings SEC-01/SEC-02).

Field Value
Operation ID OP-13
Trigger Any request through a pipeline with LegacyBolAuthMiddleware or AspNetSessionIdMiddleware registered. LegacyBolAuthMiddleware is registered by App startup configure services but never added to the pipeline (dead code*); AspNetSessionIdMiddleware is wired into the pipeline only when EnableSessionMiddleware is set (see BR-SE-17)
Inputs The HttpContext's cookie collection.
Outputs A 302 redirect response when the cookie is missing; the pipeline always continues.
Primary components LegacyBolAuthMiddleware.InvokeAsync, AspNetSessionIdMiddleware.InvokeAsync
Entry point src/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/Middleware/LegacyBolAuthMiddleware.cs (L36–47), AspNetSessionIdMiddleware.cs (L35–47)

Steps

  1. Check for cookie presence only — SAIFAUTH/SAIF.BOL.Auth for LegacyBolAuthMiddleware, or ASP.NET_SessionId for AspNetSessionIdMiddleware (BR-SE-16)
  2. The cookie's value is never validated — only its existence is checked.
  3. If missing: call GetSettingValueAsync("endpoint", "LegacySessionProvider") and issue Response.Redirect(redirectUrl), where redirectUrl is $"{context.Request.Scheme}://{context.Request.Host}{endpoint}?returnUrl={Uri.EscapeDataString(originalUrl)}" (BR-SE-16)

Origin: Step 2's setting lookup is implemented in Get setting value (SAIF.NetCore.EnvironmentClient) and executed on behalf of this operation. 3. await next(context) is invoked unconditionally, in both files, regardless of whether the cookie was present (BR-SE-16) - This is a fail-open control: the redirect response is issued, but the downstream middleware and endpoint still execute as if the request were authorized*.

Process flow

This diagram shows the per-request path shared by both LegacyBolAuthMiddleware and AspNetSessionIdMiddleware, emphasizing that await next(context) always runs regardless of the cookie-presence outcome (the fail-open behavior).

flowchart TD
    Start([Request enters middleware]) --> S1{Cookie present?}
    S1 -->|Yes| S3[await next unconditionally]
    S1 -->|No| S2[Look up LegacySessionProvider endpoint and redirect]
    S2 --> S3
    S3 --> EndOk([Pipeline continues regardless of cookie outcome])

Failure and edge-case behavior

  • Because await next(context) always runs, a missing cookie never actually blocks the request from reaching downstream middleware/endpoints — the redirect is advisory only, which is the fail-open weakness documented as SEC-01/SEC-02 in security-authorization.md.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

  • src/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/Middleware/LegacyBolAuthMiddleware.cs
  • src/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/Middleware/AspNetSessionIdMiddleware.cs