Extend "params" passed to prerender boot function to include incoming request's cookies #130

Activity

1. SteveSandersonMS

   added

   enhancement

   on Jun 14, 2016
2. SteveSandersonMS commented on Jun 21, 2016

   

   SteveSandersonMS

   on Jun 21, 2016

   Last edited by SteveSandersonMS

   MemberAuthor

   More actions

   It's now pretty trivial to do this without needing a built-in feature:

   asp-prerender-data="new { Cookies = ViewContext.HttpContext.Request.Cookies }"
   

   There are a few reasons why it might be better to leave this for developers to do if they want it, and not try to pass through all cookies by default:

   1. Perf - you could have a few KB of cookie data, so unless you are really using this in your Node code, it's not great to be serializing it across the process boundary on every RPC call for no benefit
   2. Security - cookies often provide authentication information that you don't want to leak to third parties. Passing it around increases opportunities to leak the information unexpectedly (e.g., if some part of your Node code writes the cookie data into an error message). Also, developers might be tempted to "pass through" all the incoming cookies in outgoing HTTP requests (e.g., for OAuth or similar), which could defeat the same-origin protections when calling third-party APIs unless they think this through and correctly pass through only the subset of cookie data that they want to.
   3. Usefulness - when it comes to things like ASP.NET's built-in authentication system, it's not even useful to pass the auth cookies into Node, because your Node code won't be able to interpret them. What you really want to pass through is something like the authenticated username or a list of roles.

   Therefore, my preference now is not to do this by default. Developers who want it can easily use the line of code above, or something similar but more selective about which particular bit of cookie data they want to pass through.

   If this becomes a common request, we can ask more questions about the scenarios and problems people are trying to solve, and work out what the right design will be.
3. SteveSandersonMS

   closed this as completedon Jun 21, 2016