Adding Request Filtering Middleware

[hishamco]

Request filtering is a great feature in IIS for filtering the requests based on some criteria. It will be nice to have such a middleware in ASP.NET Core FYI I already made a prototype few weeks ago https://github.com/hishamco/RequestFiltering to prove the concept

[mikaelm12]

I think a lot of the functionality you're envisioning is already provided by middleware like Map, MapWhen, or UseWhen. But if you open a PR in the BasicMiddleware repo I'm sure we could discuss more in depth what new functionality we might want to introduce and the best methods to do so.

[davidfowl]

@hishamco seems like it would be good to submit to https://github.com/aspnet-contrib.

[hishamco]

@mikaelm12 I didn't dig deeply in MapWhen and UseWhen, what I did basically an inspiration from a built-in security feature that was introduced in IIS 7.0, which I already blogged about here http://www.hishambinateya.com/request-filtering-in-asp.net-core-part-1-overview and http://www.hishambinateya.com/request-filtering-for-asp.net-core-applications-part-2-building-abstractions-and-implementations-apis @davidfowl When I saw some of the middlewares such as Rewrite & ResponseCompression I thought this is the place where should I open an issue or a PR, I was wondering if there's a plan to include such thing out of the box, but If the aspnet-contrib is the suitable place, I 'll move it there

[Tratcher]

This isn't a middleware, it's a whole new pipeline abstraction. You've gone from nested Func<HttpContext, Task> to IList<Action<RequestFilteringContext>> and all of the things you've implemented as filters are the actual middleware. Why not just implement all of those filters as first class middleware?

[hishamco]

@Tratcher I already implemented them as middlewares in the first release in my local version, and here as code snippet of how we can use them:

app.UseFileExtensionsRequestFiltering(new FileExtensionsRequestFilterOptions
{
    AllowUnlisted = true,
    FileExtensionsCollection = new List<FileExtensionsElement>
    {
         new FileExtensionsElement { FileExtension = ".ini", Allowed = false }
    }
});

app.UseHttpVerbsRequestFiltering(new HttpVerbsRequestFilterOptions
{
    AllowUnlisted = true,
    HttpVerbsCollection = new List<HttpVerbsElement>
    {
         new HttpVerbsElement { Verb = HttpVerb.Post, Allowed = false}
    }
});

app.UseHiddenSegmentsRequestFiltering(new HiddenSegmentsRequestFilterOptions
{
    HiddenSegmentsCollection = new List<HiddenSegmentsElement>
    {
        new HiddenSegmentsElement { Segment = "Admin"}
    }
});

app.UseRequestLimitsRequestFiltering(new RequestLimitsRequestFilterOptions
{
    MaxAllowedContentLength = 40960,
    HeaderLimitsCollection = new List<HeaderLimitsElement>
    {
         new HeaderLimitsElement { Header = "Content-Type", SizeLimit = 40 }
    }
});

[Tratcher]

Exactly, so what's the value of the request filter abstraction? The only differences I see is that you've made it synchronous and non-nested.

[davidfowl]

This shouldn't be in the box. Put it in contrib and if it's wildly popular we can take another look. I with @Tratcher on this one.

[hishamco]

@davidfowl how can I move it to the aspnet-contrib?

[hishamco]

If the filters are implemented as first class middleware, of course the abstraction will be come useless

[mikaelm12]

Another option is the Abort Action feature that was recently added to the Rewrite middleware.

Here is the reference doc. It essentially allows you to define basic request filtering rules for url rewrite.

[hishamco]

@mikaelm12 my intend to build an extensible & dynamic middleware, even if we don't have 'Rewrite Rules'

[muratg]

We are closing this issue because no further action is planned for this issue. If you still have any issues or questions, please log a new issue with any additional details that you have.

[hishamco]

@muratg how can I move this to aspnet-contrib?

[muratg]

@hishamco https://github-issue-mover.appspot.com/ tool works really well for me. Please give it a shot.

[hishamco]

@muratg, the problem is I didn't see a place in aspnet-contrib where I can suggest such feature

thanks

[muratg]

@PinpointTownes is there a good repo that @hishamco can submit his middleware/samples under aspnet-contrib org?

[kevinchalet]

@PinpointTownes is there a good repo that @hishamco can submit his middleware/samples under aspnet-contrib org?

Unfortunately, I don't currently have the resources needed to review and maintain new projects (at the time of writing, I already maintain 53 packages).

That said, if someone from your team was willing to dedicate some time to the aspnet-contrib initiative, I'd - of course - reconsider my position :smile: