Issues with Headers with ABP 5 solution #7624

7 Answer(s)

• 

  0

  liangshiwei created 3 months ago

  Support Team Fullstack Developer

  Hi,

  could you share the error message and some screenshots?

  Save Cancel
• 

  0

  viswajwalith created 3 months ago

  Hi,

  could you share the error message and some screenshots?

  Hi There is no error message as this is getting blocked by clients firewall system due to suspeous content of the headers shared. Let me know if you have any queries

  Save Cancel
• 

  0

  liangshiwei created 3 months ago

  Support Team Fullstack Developer

  you can try remove some headers to check if it's work

  

  Save Cancel
• 

  0

  viswajwalith created 3 months ago

  you can try remove some headers to check if it's work

  

  Ok will try and update you.

  Save Cancel
• 

  0

  liangshiwei created 3 months ago

  Support Team Fullstack Developer

  okay

  Save Cancel
• 

  0

  viswajwalith created 3 months ago

  When we tried the same by hosting in our Dev Environemnt we observed that ARRAffinity cookie is not coming at all. We are suspecting something related to Azure Web APP hosting.

  On the other hand we tried adding code to remove "ARRAffinity" by

  public class RemoveARRAffinitySameSiteCookieMiddleware { private readonly RequestDelegate _next;

   public RemoveARRAffinitySameSiteCookieMiddleware(RequestDelegate next)
   {
       _next = next;
   }
  
   public async Task InvokeAsync(HttpContext context)
   {
       context.Response.OnStarting(() =>
       {
           context.Response.Cookies.Delete("ARRAffinitySameSite");
           return Task.CompletedTask;
       });
  
       await _next(context);
   }
  

  }

  In Auth server

  public override void OnApplicationInitialization(ApplicationInitializationContext context) { var app = context.GetApplicationBuilder(); var env = context.GetEnvironment();

   var configuration = context.ServiceProvider.GetRequiredService<IConfiguration>();
  
   app.Use(async (ctx, next) =>
   {
       if (ctx.Request.Headers.ContainsKey("from-ingress"))
       {
           ctx.SetIdentityServerOrigin(configuration["App:SelfUrl"]);
       }
  
       await next();
   });
  
   if (env.IsDevelopment())
   {
       app.UseDeveloperExceptionPage();
   }
  
   app.UseAbpRequestLocalization();
  
   if (!env.IsDevelopment())
   {
       app.UseErrorPage();
   }
  
   app.UseCorrelationId();
   app.UseStaticFiles();
   app.UseRouting();
   app.UseCors();
   app.UseHttpMetrics();
   app.UseAuthentication();
   app.UseJwtTokenMiddleware();
   app.UseMultiTenancy();
   app.UseAbpSerilogEnrichers();
   app.UseUnitOfWork();
   app.UseIdentityServer();
   app.UseAuthorization();
   app.UseAuditing();
   app.UseMiddleware<EhsWatchVeSecurityHeadersMiddleware>();
   app.UseMiddleware<RemoveARRAffinitySameSiteCookieMiddleware>();
   app.UseHsts();
   app.UseConfiguredEndpoints(endpoints =>
   {
       endpoints.MapMetrics();
   });
  

  }

  but still getting that cookie .

  

  the only difference is

  • Before Value: ARRAffinitySameSite=fd496f44e02cfb761c8aa28c89623dc7a80cfa26dff26b2575b73746f0673dbb;Path=/;HttpOnly;SameSite=None;Secure;Domain=xxxxxx.xxx.xxx.xx

  • Value After code change: ARRAffinitySameSite=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/

  do you this make any difference, but still we are not sure of removing ARRAffinitySameSite because this may impact the behaviour of load balancer

  Save Cancel
• 

  0

  liangshiwei created 3 months ago

  Support Team Fullstack Developer

  consider this https://medium.com/@chikuokuo/cookie-delete-on-net-framework-677b495901b9

  Save Cancel