{"action":"created","comment":{"url":"https://api.github.com/repos/aspnet/Security/pulls/comments/42182896","id":42182896,"diff_hunk":"@@ -0,0 +1,101 @@\n+// Copyright (c) .NET Foundation. All rights reserved.\n+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.\n+\n+using System;\n+using System.Threading.Tasks;\n+using Microsoft.AspNet.Http.Features.Authentication;\n+using Microsoft.Extensions.Logging;\n+\n+namespace Microsoft.AspNet.Authentication\n+{\n+    public abstract class RemoteAuthenticationHandler<TOptions> : AuthenticationHandler<TOptions> where TOptions : RemoteAuthenticationOptions\n+    {\n+        public override async Task<bool> HandleRequestAsync()\n+        {\n+            if (Options.CallbackPath == Request.Path)\n+            {\n+                return await HandleRemoteCallbackAsync();\n+            }\n+            return false;\n+        }\n+\n+        protected virtual async Task<bool> HandleRemoteCallbackAsync()\n+        {\n+            var authResult = await HandleRemoteAuthenticateAsync();\n+            if (authResult == null || !authResult.Succeeded)\n+            {\n+                var errorContext = new ErrorContext(Context, authResult?.Error ?? new Exception(\"Invalid return state, unable to redirect.\"));\n+                Logger.LogInformation(\"Error from RemoteAuthentication: \" + errorContext.Error.Message);\n+                await Options.Events.RemoteError(errorContext);\n+                if (errorContext.HandledResponse)\n+                {\n+                    return true;\n+                }\n+                if (errorContext.Skipped)\n+                {\n+                    return false;\n+                }\n+\n+                Context.Response.StatusCode = 500;\n+                return true;\n+            }\n+\n+            // We have a ticket if we get here\n+            var ticket = authResult.Ticket;\n+            var context = new TicketReceivedContext(Context, Options, ticket)\n+            {\n+                ReturnUri = ticket.Properties.RedirectUri,\n+            };\n+            // REVIEW: is this safe or good?\n+            ticket.Properties.RedirectUri = null;\n+\n+            await Options.Events.TicketReceived(context);\n+\n+            if (context.HandledResponse)\n+            {\n+                Logger.LogVerbose(\"The SigningIn event returned Handled.\");\n+                return true;\n+            }\n+            else if (context.Skipped)\n+            {\n+                Logger.LogVerbose(\"The SigningIn event returned Skipped.\");\n+                return false;\n+            }\n+\n+            if (context.Principal != null)","path":"src/Microsoft.AspNet.Authentication/RemoteAuthenticationHandler.cs","position":65,"original_position":65,"commit_id":"4407e7658a31ecb9270fad8f8c45b12bfae4b337","original_commit_id":"4407e7658a31ecb9270fad8f8c45b12bfae4b337","user":{"login":"HaoK","id":6537861,"avatar_url":"https://avatars.githubusercontent.com/u/6537861?v=3","gravatar_id":"","url":"https://api.github.com/users/HaoK","html_url":"https://github.com/HaoK","followers_url":"https://api.github.com/users/HaoK/followers","following_url":"https://api.github.com/users/HaoK/following{/other_user}","gists_url":"https://api.github.com/users/HaoK/gists{/gist_id}","starred_url":"https://api.github.com/users/HaoK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HaoK/subscriptions","organizations_url":"https://api.github.com/users/HaoK/orgs","repos_url":"https://api.github.com/users/HaoK/repos","events_url":"https://api.github.com/users/HaoK/events{/privacy}","received_events_url":"https://api.github.com/users/HaoK/received_events","type":"User","site_admin":false},"body":"The problem is we allow AuthenticationTickets with null principals.  So we can't easily block this unless we change that.","created_at":"2015-10-15T21:27:23Z","updated_at":"2015-10-15T21:27:23Z","html_url":"https://github.com/aspnet/Security/pull/495#discussion_r42182896","pull_request_url":"https://api.github.com/repos/aspnet/Security/pulls/495","_links":{"self":{"href":"https://api.github.com/repos/aspnet/Security/pulls/comments/42182896"},"html":{"href":"https://github.com/aspnet/Security/pull/495#discussion_r42182896"},"pull_request":{"href":"https://api.github.com/repos/aspnet/Security/pulls/495"}}},"pull_request":{"url":"https://api.github.com/repos/aspnet/Security/pulls/495","id":46068405,"html_url":"https://github.com/aspnet/Security/pull/495","diff_url":"https://github.com/aspnet/Security/pull/495.diff","patch_url":"https://github.com/aspnet/Security/pull/495.patch","issue_url":"https://api.github.com/repos/aspnet/Security/issues/495","number":495,"state":"closed","locked":false,"title":"Add RemoteAuthenticationHandler base (support for error handling)","user":{"login":"HaoK","id":6537861,"avatar_url":"https://avatars.githubusercontent.com/u/6537861?v=3","gravatar_id":"","url":"https://api.github.com/users/HaoK","html_url":"https://github.com/HaoK","followers_url":"https://api.github.com/users/HaoK/followers","following_url":"https://api.github.com/users/HaoK/following{/other_user}","gists_url":"https://api.github.com/users/HaoK/gists{/gist_id}","starred_url":"https://api.github.com/users/HaoK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HaoK/subscriptions","organizations_url":"https://api.github.com/users/HaoK/orgs","repos_url":"https://api.github.com/users/HaoK/repos","events_url":"https://api.github.com/users/HaoK/events{/privacy}","received_events_url":"https://api.github.com/users/HaoK/received_events","type":"User","site_admin":false},"body":"cc @Tratcher ","created_at":"2015-09-25T23:31:02Z","updated_at":"2015-10-15T21:27:23Z","closed_at":"2015-10-15T06:10:59Z","merged_at":null,"merge_commit_sha":"af3c632eea4b66c90f89d3956ccbcd6893fdee3f","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/aspnet/Security/pulls/495/commits","review_comments_url":"https://api.github.com/repos/aspnet/Security/pulls/495/comments","review_comment_url":"https://api.github.com/repos/aspnet/Security/pulls/comments{/number}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/495/comments","statuses_url":"https://api.github.com/repos/aspnet/Security/statuses/4407e7658a31ecb9270fad8f8c45b12bfae4b337","head":{"label":"aspnet:haok9-25/errors","ref":"haok9-25/errors","sha":"4407e7658a31ecb9270fad8f8c45b12bfae4b337","user":{"login":"aspnet","id":6476660,"avatar_url":"https://avatars.githubusercontent.com/u/6476660?v=3","gravatar_id":"","url":"https://api.github.com/users/aspnet","html_url":"https://github.com/aspnet","followers_url":"https://api.github.com/users/aspnet/followers","following_url":"https://api.github.com/users/aspnet/following{/other_user}","gists_url":"https://api.github.com/users/aspnet/gists{/gist_id}","starred_url":"https://api.github.com/users/aspnet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aspnet/subscriptions","organizations_url":"https://api.github.com/users/aspnet/orgs","repos_url":"https://api.github.com/users/aspnet/repos","events_url":"https://api.github.com/users/aspnet/events{/privacy}","received_events_url":"https://api.github.com/users/aspnet/received_events","type":"Organization","site_admin":false},"repo":{"id":17723699,"name":"Security","full_name":"aspnet/Security","owner":{"login":"aspnet","id":6476660,"avatar_url":"https://avatars.githubusercontent.com/u/6476660?v=3","gravatar_id":"","url":"https://api.github.com/users/aspnet","html_url":"https://github.com/aspnet","followers_url":"https://api.github.com/users/aspnet/followers","following_url":"https://api.github.com/users/aspnet/following{/other_user}","gists_url":"https://api.github.com/users/aspnet/gists{/gist_id}","starred_url":"https://api.github.com/users/aspnet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aspnet/subscriptions","organizations_url":"https://api.github.com/users/aspnet/orgs","repos_url":"https://api.github.com/users/aspnet/repos","events_url":"https://api.github.com/users/aspnet/events{/privacy}","received_events_url":"https://api.github.com/users/aspnet/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/aspnet/Security","description":"Middleware for security and authorization of web apps.","fork":false,"url":"https://api.github.com/repos/aspnet/Security","forks_url":"https://api.github.com/repos/aspnet/Security/forks","keys_url":"https://api.github.com/repos/aspnet/Security/keys{/key_id}","collaborators_url":"https://api.github.com/repos/aspnet/Security/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/aspnet/Security/teams","hooks_url":"https://api.github.com/repos/aspnet/Security/hooks","issue_events_url":"https://api.github.com/repos/aspnet/Security/issues/events{/number}","events_url":"https://api.github.com/repos/aspnet/Security/events","assignees_url":"https://api.github.com/repos/aspnet/Security/assignees{/user}","branches_url":"https://api.github.com/repos/aspnet/Security/branches{/branch}","tags_url":"https://api.github.com/repos/aspnet/Security/tags","blobs_url":"https://api.github.com/repos/aspnet/Security/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/aspnet/Security/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/aspnet/Security/git/refs{/sha}","trees_url":"https://api.github.com/repos/aspnet/Security/git/trees{/sha}","statuses_url":"https://api.github.com/repos/aspnet/Security/statuses/{sha}","languages_url":"https://api.github.com/repos/aspnet/Security/languages","stargazers_url":"https://api.github.com/repos/aspnet/Security/stargazers","contributors_url":"https://api.github.com/repos/aspnet/Security/contributors","subscribers_url":"https://api.github.com/repos/aspnet/Security/subscribers","subscription_url":"https://api.github.com/repos/aspnet/Security/subscription","commits_url":"https://api.github.com/repos/aspnet/Security/commits{/sha}","git_commits_url":"https://api.github.com/repos/aspnet/Security/git/commits{/sha}","comments_url":"https://api.github.com/repos/aspnet/Security/comments{/number}","issue_comment_url":"https://api.github.com/repos/aspnet/Security/issues/comments{/number}","contents_url":"https://api.github.com/repos/aspnet/Security/contents/{+path}","compare_url":"https://api.github.com/repos/aspnet/Security/compare/{base}...{head}","merges_url":"https://api.github.com/repos/aspnet/Security/merges","archive_url":"https://api.github.com/repos/aspnet/Security/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/aspnet/Security/downloads","issues_url":"https://api.github.com/repos/aspnet/Security/issues{/number}","pulls_url":"https://api.github.com/repos/aspnet/Security/pulls{/number}","milestones_url":"https://api.github.com/repos/aspnet/Security/milestones{/number}","notifications_url":"https://api.github.com/repos/aspnet/Security/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/aspnet/Security/labels{/name}","releases_url":"https://api.github.com/repos/aspnet/Security/releases{/id}","created_at":"2014-03-13T19:44:34Z","updated_at":"2015-10-12T00:33:22Z","pushed_at":"2015-10-15T19:38:09Z","git_url":"git://github.com/aspnet/Security.git","ssh_url":"git@github.com:aspnet/Security.git","clone_url":"https://github.com/aspnet/Security.git","svn_url":"https://github.com/aspnet/Security","homepage":"","size":7311,"stargazers_count":208,"watchers_count":208,"language":"C#","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":88,"mirror_url":null,"open_issues_count":64,"forks":88,"open_issues":64,"watchers":208,"default_branch":"dev"}},"base":{"label":"aspnet:dev","ref":"dev","sha":"bfc1fcf4217eeec97583b530db22d087d39fecb3","user":{"login":"aspnet","id":6476660,"avatar_url":"https://avatars.githubusercontent.com/u/6476660?v=3","gravatar_id":"","url":"https://api.github.com/users/aspnet","html_url":"https://github.com/aspnet","followers_url":"https://api.github.com/users/aspnet/followers","following_url":"https://api.github.com/users/aspnet/following{/other_user}","gists_url":"https://api.github.com/users/aspnet/gists{/gist_id}","starred_url":"https://api.github.com/users/aspnet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aspnet/subscriptions","organizations_url":"https://api.github.com/users/aspnet/orgs","repos_url":"https://api.github.com/users/aspnet/repos","events_url":"https://api.github.com/users/aspnet/events{/privacy}","received_events_url":"https://api.github.com/users/aspnet/received_events","type":"Organization","site_admin":false},"repo":{"id":17723699,"name":"Security","full_name":"aspnet/Security","owner":{"login":"aspnet","id":6476660,"avatar_url":"https://avatars.githubusercontent.com/u/6476660?v=3","gravatar_id":"","url":"https://api.github.com/users/aspnet","html_url":"https://github.com/aspnet","followers_url":"https://api.github.com/users/aspnet/followers","following_url":"https://api.github.com/users/aspnet/following{/other_user}","gists_url":"https://api.github.com/users/aspnet/gists{/gist_id}","starred_url":"https://api.github.com/users/aspnet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aspnet/subscriptions","organizations_url":"https://api.github.com/users/aspnet/orgs","repos_url":"https://api.github.com/users/aspnet/repos","events_url":"https://api.github.com/users/aspnet/events{/privacy}","received_events_url":"https://api.github.com/users/aspnet/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/aspnet/Security","description":"Middleware for security and authorization of web apps.","fork":false,"url":"https://api.github.com/repos/aspnet/Security","forks_url":"https://api.github.com/repos/aspnet/Security/forks","keys_url":"https://api.github.com/repos/aspnet/Security/keys{/key_id}","collaborators_url":"https://api.github.com/repos/aspnet/Security/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/aspnet/Security/teams","hooks_url":"https://api.github.com/repos/aspnet/Security/hooks","issue_events_url":"https://api.github.com/repos/aspnet/Security/issues/events{/number}","events_url":"https://api.github.com/repos/aspnet/Security/events","assignees_url":"https://api.github.com/repos/aspnet/Security/assignees{/user}","branches_url":"https://api.github.com/repos/aspnet/Security/branches{/branch}","tags_url":"https://api.github.com/repos/aspnet/Security/tags","blobs_url":"https://api.github.com/repos/aspnet/Security/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/aspnet/Security/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/aspnet/Security/git/refs{/sha}","trees_url":"https://api.github.com/repos/aspnet/Security/git/trees{/sha}","statuses_url":"https://api.github.com/repos/aspnet/Security/statuses/{sha}","languages_url":"https://api.github.com/repos/aspnet/Security/languages","stargazers_url":"https://api.github.com/repos/aspnet/Security/stargazers","contributors_url":"https://api.github.com/repos/aspnet/Security/contributors","subscribers_url":"https://api.github.com/repos/aspnet/Security/subscribers","subscription_url":"https://api.github.com/repos/aspnet/Security/subscription","commits_url":"https://api.github.com/repos/aspnet/Security/commits{/sha}","git_commits_url":"https://api.github.com/repos/aspnet/Security/git/commits{/sha}","comments_url":"https://api.github.com/repos/aspnet/Security/comments{/number}","issue_comment_url":"https://api.github.com/repos/aspnet/Security/issues/comments{/number}","contents_url":"https://api.github.com/repos/aspnet/Security/contents/{+path}","compare_url":"https://api.github.com/repos/aspnet/Security/compare/{base}...{head}","merges_url":"https://api.github.com/repos/aspnet/Security/merges","archive_url":"https://api.github.com/repos/aspnet/Security/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/aspnet/Security/downloads","issues_url":"https://api.github.com/repos/aspnet/Security/issues{/number}","pulls_url":"https://api.github.com/repos/aspnet/Security/pulls{/number}","milestones_url":"https://api.github.com/repos/aspnet/Security/milestones{/number}","notifications_url":"https://api.github.com/repos/aspnet/Security/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/aspnet/Security/labels{/name}","releases_url":"https://api.github.com/repos/aspnet/Security/releases{/id}","created_at":"2014-03-13T19:44:34Z","updated_at":"2015-10-12T00:33:22Z","pushed_at":"2015-10-15T19:38:09Z","git_url":"git://github.com/aspnet/Security.git","ssh_url":"git@github.com:aspnet/Security.git","clone_url":"https://github.com/aspnet/Security.git","svn_url":"https://github.com/aspnet/Security","homepage":"","size":7311,"stargazers_count":208,"watchers_count":208,"language":"C#","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":88,"mirror_url":null,"open_issues_count":64,"forks":88,"open_issues":64,"watchers":208,"default_branch":"dev"}},"_links":{"self":{"href":"https://api.github.com/repos/aspnet/Security/pulls/495"},"html":{"href":"https://github.com/aspnet/Security/pull/495"},"issue":{"href":"https://api.github.com/repos/aspnet/Security/issues/495"},"comments":{"href":"https://api.github.com/repos/aspnet/Security/issues/495/comments"},"review_comments":{"href":"https://api.github.com/repos/aspnet/Security/pulls/495/comments"},"review_comment":{"href":"https://api.github.com/repos/aspnet/Security/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/aspnet/Security/pulls/495/commits"},"statuses":{"href":"https://api.github.com/repos/aspnet/Security/statuses/4407e7658a31ecb9270fad8f8c45b12bfae4b337"}}}}