Merge to Live#37297
Merged
Merged
Conversation
* Update CSRF docs for deferred antiforgery validation Reconcile the automatic CSRF protection docs with the deferred validation model where CsrfProtectionMiddleware records a verdict on IAntiforgeryValidationFeature instead of short-circuiting, and form consumers enforce it. Adds deferred-validation, token-precedence, and Blazor SSR sections, updates examples to form-based scenarios, refreshes diagnostics strings, and documents the migration breaking changes and caveats. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add Blazor SSR antiforgery breaking-change article Document the .NET 11 breaking change where Blazor static server-side rendering defers antiforgery validation to middleware and skips token generation when no token middleware ran. Adds the breaking-changes article, indexes it in overview.md and toc.yml, and cross-links it from the CSRF reference and migration articles. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Rename breaking-change file to avoid ssr abbreviation Spell out server-side-rendering in the filename to satisfy the repo filename rules, and update the overview index, toc.yml, and cross-links accordingly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Rename breaking-change file to avoid disallowed filename tokens Spell out the filename fully (no ssr abbreviation, no antiforgery closed compound) to clear the filename suggestion from the docs build, and update the overview index, toc.yml, and cross-links accordingly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Wade Pickett <wpickett@microsoft.com> * Address Copilot review feedback - csrf-protection.md: bridge "denied" verdict to the "invalid" feature state so the Deferred validation, code, and log terminology line up; refresh description for the deferred-enforcement model; bump ms.date. - migration/antiforgery-to-csrf.md: bump ms.date. - breaking-changes/11/overview.md: sort front matter alphabetically after title; bump ms.date. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Wade Pickett <wpickett@microsoft.com>
…ported (#37276) * Retire standalone unions article; distribute in-context Addresses #37275 (retire fundamentals/unions.md and integrate per-area) and #37274 (Blazor-specific notes in the relevant Blazor articles). C# unions are a language feature whose ASP.NET Core surface is small and flows through existing serialization-driven features. A standalone article under Fundamentals overstates the concept and forces readers to leave the article they were already in. This change: * Deletes aspnetcore/fundamentals/unions.md and removes its TOC entry. * Adds a redirect to fundamentals/minimal-apis/responses (the most common starting point for union usage). * Adds one short, moniker-gated (>= aspnetcore-11.0) note in each of: - fundamentals/minimal-apis/responses.md - web-api/action-return-types.md - signalr/hubs.md (JsonHubProtocol only) - fundamentals/openapi/aspnetcore-openapi.md (anyOf schema) - blazor/components/index.md (union component parameters + Razor literal-attribute workaround, tracked at dotnet/razor#13188) - blazor/components/dynamiccomponent.md (boxing rule) - blazor/state-management/prerendered-state-persistence.md (JsonSerializerContext doesn't flow into the unions deserializer) Each note links to the System.Text.Json unions article for the serialization behavior (case selection, classifiers, ambiguity) that's independent of ASP.NET Core. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Focus on where unions aren't supported; revert affirmative inserts Follows reviewer feedback: assume STJ rules apply wherever JSON serialization is used. Don't repeat union behavior in every JSON surface; only call out the cases where unions are unsupported but a reader might expect them to work. Reverted: * fundamentals/minimal-apis/responses.md * web-api/action-return-types.md * fundamentals/openapi/aspnetcore-openapi.md * blazor/state-management/prerendered-state-persistence.md * The Toast example in blazor/components/index.md * The SaveOutcome example in signalr/hubs.md Kept / restructured (all moniker-gated >= aspnetcore-11.0): * blazor/components/index.md: Razor string-literal shortcut doesn't apply to union-typed parameters; relocated next to the existing string-literal documentation. * blazor/components/dynamiccomponent.md: DynamicComponent boxing rule for union parameters; slimmed to a NOTE block. * signalr/hubs.md: slimmed to a NOTE that MessagePack and Newtonsoft.Json hub protocols don't support unions. Added explicit not-supported notes: * fundamentals/minimal-apis/includes/parameter-binding8-10.md: unions are supported only as body (JSON); not in route/query/header/form. Links dotnet/aspnetcore#66648. * mvc/models/model-binding.md: same callout for [FromBody] vs other binding sources. Links dotnet/aspnetcore#66648. * blazor/fundamentals/navigation.md: [SupplyParameterFromQuery] and [SupplyParameterFromForm] don't support unions. Links #66648. Redirect updated to point at fundamentals/minimal-apis/parameter-binding (where the most relevant ASP.NET Core-specific not-supported note lives). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Drop redirect, DynamicComponent note, parameter-binding.md date, and #66648 links Follow-up to reviewer feedback: * Drop the redirect entry. The unions.md article only ever shipped in preview docs, so no production redirect target is needed. * Revert blazor/components/dynamiccomponent.md. The DynamicComponent boxing behavior follows normal C# rules and produces a useful runtime error message; union-typed parameters won't be common enough to warrant a dedicated note. * Revert ms.date on fundamentals/minimal-apis/parameter-binding.md (only the include file changed; parent prose is unchanged). * Remove dotnet/aspnetcore#66648 references from the three non-body binding notes. Future support isn't certain enough to advertise. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add Blazor route parameters to the not-supported list Blazor route parameters parse route segments as strings without JSON parsing, so a [Parameter] typed as a C# union can't be populated from a route segment. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix build warnings * signalr/hubs.md: close the outer >= aspnetcore-8.0 moniker block around the new >= aspnetcore-11.0 insert so the inner block parses correctly. Fixes 'No moniker-end found for >= aspnetcore-11.0' warning. * release-notes/aspnetcore-11/includes/csharp-unions-preview-6.md: rewrite to match the PR principles. Drops the broken xref to the deleted unions.md, links to the C# language reference and STJ docs instead of duplicating STJ behavior, and points readers to the in-context not-supported notes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Update aspnetcore/release-notes/aspnetcore-11/includes/csharp-unions-preview-6.md Co-authored-by: Wade Pickett <wpickett@microsoft.com> * Update aspnetcore/blazor/components/index.md Co-authored-by: Luke Latham <1622880+guardrex@users.noreply.github.com> * Update aspnetcore/mvc/models/model-binding.md Co-authored-by: Luke Latham <1622880+guardrex@users.noreply.github.com> * Update aspnetcore/fundamentals/minimal-apis/includes/parameter-binding8-10.md Co-authored-by: Luke Latham <1622880+guardrex@users.noreply.github.com> * Apply suggestion from @danroth27 --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Wade Pickett <wpickett@microsoft.com> Co-authored-by: Luke Latham <1622880+guardrex@users.noreply.github.com>
Contributor
|
Status checker is not able to finish and seems to be stuck. However, each of the PR's contributing to this PR to live are ones I just reviewed, approved, and had passed checks. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[AUTOMATED]
Internal previews