elsa-workflows / elsa-workflows/elsa-core

Dispatch and Trigger Controller Actions Unexpectedly Included in all Swagger API Definitions in a Solution

Open
#2,700 2 comments 1 reaction 0 assignees View on GitHub
enhancement triaged
Dominant language
C#
Stars
7.9k
Forks
1.5k
Avg merge
15h 22m
Merged PRs (30d)
114

Description

### Type:
Bug

### Summary
**Actual Behavior**: `Elsa.Activities.Http` `DispatchEndPoint` and `TriggerEndPoint` endpoints are showing up in _all_ Swagger API Definitions for _all_ Web API projects in a solution, even when not explicitly configured to do so

**Expected Behavior**: the `Elsa.Activities.Http` `DispatchEndPoint` and `TriggerEndPoint` endpoints should only show up in Swagger API Definitions when they have been explicitly configured to be part of the Web API project

For a quick visual of the issue, see the screenshots at the end of this ticket

### Problem This Causes
- It is alarming, and a potential security concern, to find endpoints exposed through your own API without explicit configuration
- In solutions with multiple Web API projects, the DispatchEndPoint and TriggerEndPoint somehow show up in all the Web API projects, not just the Web API projects for the Elsa workflow API

### Reproduction Steps
1. Create a new Web API Project in Visual Studio
2. Run Web API and navigate to the Swagger UI Page (See Screenshot A below)
3. Observer only the Get /WeatherForcast Endpoint
4. Stop Web API, and add Elsa.Activities.Http
- Note: **Do NOT configure any Elsa services** in the startup.cs (or program.cs) file
5. Run Web API and navigate to the Swagger UI page
6. Observe the DispatchEndPoint and TriggerEndPoint (See Screenshot B below)

### Environment
- Windows 10
- Visual Studio 2022
- .Net 6
- Elsa.Activities.Http v2.4.0.1

### Screenshots
**A) --- Vanilla Web API Project ---**

![image](https://user-images.githubusercontent.com/39815557/150977393-79d35e87-1b98-4f5d-b38a-f63a41903af4.png)

**B) --- Vanilla Web API Project, `Elsa.Activities.Http` Nuget Package references, but **no Elsa configuration** ---**

![image](https://user-images.githubusercontent.com/39815557/150977311-bd93ce93-eff6-4188-bc36-0ed77ac4e284.png)

### Coding Comments
Looking at the source code, I have been unable to see exactly how or why this controller self-registration behavior happens, and am very curious to understand the mechanism by which it occurs. I think maybe the 'Add Features' method is getting executed in the [ElsaOptionsBuilder class](https://github.com/elsa-workflows/elsa-core/blob/f12ad05932cd35fb4dc9a87d81aa4caf89fe316a/src/core/Elsa.Core/Extensions/ElsaOptionBuilderExtensions.cs#L20), but how/why is this method getting excuted?

### Other Comments
Thanks for the great work on this library. I have been looking for an alternative to 'Azure Logic Apps' that is better suited to local and cross-platform development - and this looks like a great fit.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.