Repository navigation
Fix External Hub Antiforgery Cookies and Strengthen CSRF Regression Tests - #148
Merged
Merged
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## dev #148 +/- ##
==========================================
+ Coverage 87.21% 87.22% +0.01%
==========================================
Files 580 580
Lines 18891 18908 +17
Branches 2227 2227
==========================================
+ Hits 16475 16492 +17
Misses 1614 1614
Partials 802 802
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
mckaragoz
added a commit
that referenced
this pull request
Nov 7, 2026
* feat(docs): showcase Identity Lab and enhance landing page experience (#143) * Add GitHub Actions workflow for JavaScript tests * Enhance JavaScript tests workflow with change detection Updated workflow to include permissions and detect changes step. * Merge commit from fork * advisory-fix-1 * Fix Reviewed Issues * Fix Conflicts & Tests * test: Add CSRF regression coverage and update endpoint classification (#144) * test: Add CSRF regression coverage and update endpoint classification * Fix TrustedOrigin in Request Client and Client Bootstrapper * Fix UAuthUrlBuilder when Tenant Specified (#145) * Fix UAuthUrlBuilder when Tenant Specified * Fix Flaky Logout Test * More Fixes * More Fixes * Modernize Dependencies, Test Infrastructure and CI Workflows (#146) * Update Dependencies & Identity Lab Arrangements * test: propagate xUnit v3 cancellation tokens Pass the current xUnit test cancellation token to ordinary asynchronous test operations in unit, integration, and Identity Lab tests. Keep exact token matching in the snapshot factory mock and qualify the xUnit context where bUnit also defines TestContext. Preserve explicit cancellation sources and non-cancellable operations. Leave the two transaction cleanup rollbacks uncancellable, with explanatory comments. Validation: xUnit1051 decreases from 2,403 to 2 intentional cleanup exceptions. * ci: migrate .NET 10 tests to Microsoft.Testing.Platform * build: centralize supported frameworks and derive CI compatibility matrix * ci: standardize workflow checks and conditional PR validation * Some Additional Changes * Enforce Device Binding in Session Validation (#147) * Enforce Device Binding in Session Validation * Fix Antiforgery Behavior on Device Hardening * Fix External Hub Antiforgery Cookies and Strengthen CSRF Regression Tests (#148) * Improve Identity Lab Login UX and Sidebar Footer (#149) * Improve Identity Lab Login UX and Sidebar Footer * Completed Implementations * Update 0.2.0-preview.2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes cross-site antiforgery cookie compatibility for External Hub deployments and strengthens CSRF regression tests.
Changes
SameSite=NoneandSecurePolicy=Alwaysfor External Hub deployments.SameSite=Strictfor Embedded and Integrated deployments.Security
CSRF validation remains enforced. Requests with missing or forged tokens continue to be rejected without changing authentication or session state.
Validation