Unit tests added

Author: Thorium

src/Giraffe/Core.fs

@@ -243,42 +243,65 @@ module Core =
                 | true -> next ctx
                 | false -> skipPipeline
 
+    /// <summary>
+    /// Validates if a redirect URL is safe (prevents open redirect vulnerabilities).
+    /// Allows only relative URLs or URLs with the same host.
+    /// </summary>
+    /// <param name="ctx">The HttpContext to get the request host from.</param>
+    /// <param name="url">The URL to validate.</param>
+    /// <returns>True if the URL is safe to redirect to, false otherwise.</returns>
+    let isValidRedirectUrl (ctx: HttpContext) (url: string) =
+        if String.IsNullOrWhiteSpace url then
+            false
+        elif url.StartsWith '/' then
+            true // Relative URL
+        elif url.StartsWith "~/" then
+            true // App-relative URL
+        else
+            match Uri.TryCreate(url, UriKind.Absolute) with
+            | true, uri ->
+                // Only allow redirects to the same host
+                let requestHost = ctx.Request.Host
+                uri.Host = requestHost.Host
+            | false, _ -> false
+
     /// <summary>
     /// Redirects to a different location with a `302` or `301` (when permanent) HTTP status code.
+    /// Validates the redirect URL to prevent open redirect vulnerabilities.
     /// </summary>
     /// <param name="permanent">If true the redirect is permanent (301), otherwise temporary (302).</param>
     /// <param name="location">The URL to redirect the client to.</param>
+    /// <param name="invalidRedirectHandler">Optional custom handler for invalid redirects. If None, returns 400 Bad Request with logged warning.</param>
     /// <param name="next"></param>
     /// <param name="ctx"></param>
     /// <returns>A Giraffe <see cref="HttpHandler"/> function which can be composed into a bigger web application.</returns>
-    let redirectTo (permanent: bool) (location: string) : HttpHandler =
+    let redirectToExt (permanent: bool) (location: string) (invalidRedirectHandler: HttpHandler option) : HttpHandler =
         fun (next: HttpFunc) (ctx: HttpContext) ->
-            // Validate redirect URL to prevent open redirect vulnerabilities
-            // Allow only relative URLs or URLs with the same host
-            let isValidRedirect (url: string) =
-                if String.IsNullOrWhiteSpace(url) then
-                    false
-                elif url.StartsWith("/") then
-                    true // Relative URL
-                elif url.StartsWith("~/") then
-                    true // App-relative URL
-                else
-                    match Uri.TryCreate(url, UriKind.Absolute) with
-                    | true, uri ->
-                        // Only allow redirects to the same host
-                        let requestHost = ctx.Request.Host
-                        uri.Host = requestHost.Host
-                    | false, _ -> false
-
-            if isValidRedirect location then
+            if isValidRedirectUrl ctx location then
                 ctx.Response.Redirect(location, permanent)
                 Task.FromResult(Some ctx)
             else
-                // Log suspicious redirect attempt
-                let logger = ctx.GetLogger("Giraffe.Core")
-                logger.LogWarning("Blocked potential open redirect to: {Location}", location)
-                ctx.Response.StatusCode <- 400
-                Task.FromResult(Some ctx)
+                let defaultHandler =
+                    fun (next: HttpFunc) (ctx: HttpContext) ->
+                        let logger = ctx.GetLogger("Giraffe.Core")
+                        logger.LogWarning("Blocked potential open redirect to: {Location}", location)
+                        ctx.Response.StatusCode <- 400
+                        Task.FromResult(Some ctx)
+
+                let handler = invalidRedirectHandler |> Option.defaultValue defaultHandler
+                handler earlyReturn ctx
+
+    /// <summary>
+    /// Redirects to a different location with a `302` or `301` (when permanent) HTTP status code.
+    /// Validates the redirect URL to prevent open redirect vulnerabilities.
+    /// Uses default error handling (400 Bad Request) for invalid redirects.
+    /// </summary>
+    /// <param name="permanent">If true the redirect is permanent (301), otherwise temporary (302).</param>
+    /// <param name="location">The URL to redirect the client to.</param>
+    /// <param name="next"></param>
+    /// <param name="ctx"></param>
+    /// <returns>A Giraffe <see cref="HttpHandler"/> function which can be composed into a bigger web application.</returns>
+    let redirectTo (permanent: bool) (location: string) : HttpHandler = redirectToExt permanent location None
 
     // ---------------------------
     // Model binding functions

src/Giraffe/Csrf.fs

@@ -9,10 +9,13 @@ module Csrf =
     open System
     open System.Security.Cryptography
     open System.Text
+    open System.Threading.Tasks
     open Microsoft.AspNetCore.Http
     open Microsoft.Extensions.Logging
     open Microsoft.AspNetCore.Antiforgery
 
+    // Defaults are selected to what developers would expect from ASP.NET Core application.
+
     /// <summary>
     /// Default CSRF token header name
     /// </summary>
@@ -29,36 +32,67 @@ module Csrf =
     /// Validates the CSRF token from the request.
     /// Checks for token in header (X-CSRF-TOKEN) or form field (__RequestVerificationToken).
     /// </summary>
+    /// <param name="invalidTokenHandler">Optional custom handler for invalid tokens. If None, returns 403 Forbidden with logged warning.</param>
     /// <param name="next">The next HttpFunc</param>
     /// <param name="ctx">The HttpContext</param>
     /// <returns>HttpFuncResult</returns>
-    let validateCsrfToken: HttpHandler =
+    let validateCsrfTokenExt (invalidTokenHandler: HttpHandler option) : HttpHandler =
         fun (next: HttpFunc) (ctx: HttpContext) ->
             task {
                 let antiforgery = ctx.GetService<IAntiforgery>()
 
                 try
-                    let! isValid = antiforgery.IsRequestValidAsync(ctx)
+                    let! isValid = antiforgery.IsRequestValidAsync ctx
 
                     if isValid then
                         return! next ctx
                     else
-                        let logger = ctx.GetLogger("Giraffe.Csrf")
-                        logger.LogWarning("CSRF token validation failed for request to {Path}", ctx.Request.Path)
-                        ctx.Response.StatusCode <- 403
-                        return Some ctx
+                        let defaultHandler =
+                            fun (next: HttpFunc) (ctx: HttpContext) ->
+                                let logger = ctx.GetLogger("Giraffe.Csrf")
+
+                                logger.LogWarning(
+                                    "CSRF token validation failed for request to {Path}",
+                                    ctx.Request.Path
+                                )
+
+                                ctx.Response.StatusCode <- 403
+                                Task.FromResult(Some ctx)
+
+                        let handler = invalidTokenHandler |> Option.defaultValue defaultHandler
+                        return! handler earlyReturn ctx
                 with ex ->
-                    let logger = ctx.GetLogger("Giraffe.Csrf")
-                    logger.LogWarning(ex, "CSRF token validation error for request to {Path}", ctx.Request.Path)
-                    ctx.Response.StatusCode <- 403
-                    return Some ctx
+                    let defaultHandler =
+                        fun (next: HttpFunc) (ctx: HttpContext) ->
+                            let logger = ctx.GetLogger("Giraffe.Csrf")
+                            logger.LogWarning(ex, "CSRF token validation error for request to {Path}", ctx.Request.Path)
+                            ctx.Response.StatusCode <- 403
+                            Task.FromResult(Some ctx)
+
+                    let handler = invalidTokenHandler |> Option.defaultValue defaultHandler
+                    return! handler earlyReturn ctx
             }
 
+    /// <summary>
+    /// Validates the CSRF token from the request with default error handling.
+    /// Checks for token in header (X-CSRF-TOKEN) or form field (__RequestVerificationToken).
+    /// Uses default error handling (403 Forbidden) for invalid tokens.
+    /// </summary>
+    /// <param name="next">The next HttpFunc</param>
+    /// <param name="ctx">The HttpContext</param>
+    /// <returns>HttpFuncResult</returns>
+    let validateCsrfToken: HttpHandler = validateCsrfTokenExt None
+
     /// <summary>
     /// Alias for validateCsrfToken - validates anti-forgery tokens from requests.
     /// </summary>
     let requireAntiforgeryToken = validateCsrfToken
 
+    /// <summary>
+    /// Alias for validateCsrfTokenExt - validates anti-forgery tokens from requests with custom error handler.
+    /// </summary>
+    let requireAntiforgeryTokenExt = validateCsrfTokenExt
+
     /// <summary>
     /// Generates a CSRF token and adds it to the HttpContext items for use in views.
     /// The token can be accessed via ctx.Items["CsrfToken"] and ctx.Items["CsrfTokenHeaderName"].
@@ -70,7 +104,7 @@ module Csrf =
         fun (next: HttpFunc) (ctx: HttpContext) ->
             task {
                 let antiforgery = ctx.GetService<IAntiforgery>()
-                let tokens = antiforgery.GetAndStoreTokens(ctx)
+                let tokens = antiforgery.GetAndStoreTokens ctx
 
                 // Store token for view rendering
                 ctx.Items.["CsrfToken"] <- tokens.RequestToken
@@ -90,7 +124,7 @@ module Csrf =
         fun (next: HttpFunc) (ctx: HttpContext) ->
             task {
                 let antiforgery = ctx.GetService<IAntiforgery>()
-                let tokens = antiforgery.GetAndStoreTokens(ctx)
+                let tokens = antiforgery.GetAndStoreTokens ctx
 
                 let response =
                     {|

tests/Giraffe.Tests/Giraffe.Tests.fsproj

@@ -22,6 +22,7 @@
     <Compile Include="PreconditionalTests.fs" />
     <Compile Include="JsonTests.fs" />
     <Compile Include="XmlTests.fs" />
+    <Compile Include="SecurityTests.fs" />
   </ItemGroup>
 
   <ItemGroup>