elsa-workflows / elsa-workflows/elsa-core
Dispatch and Trigger Controller Actions Unexpectedly Included in all Swagger API Definitions in a Solution
- Dominant language
- C#
- Stars
- 7.9k
- Forks
- 1.5k
- Avg merge
- 15h 22m
- Merged PRs (30d)
- 114
Description
### Type:
Bug
### Summary
**Actual Behavior**: `Elsa.Activities.Http` `DispatchEndPoint` and `TriggerEndPoint` endpoints are showing up in _all_ Swagger API Definitions for _all_ Web API projects in a solution, even when not explicitly configured to do so
**Expected Behavior**: the `Elsa.Activities.Http` `DispatchEndPoint` and `TriggerEndPoint` endpoints should only show up in Swagger API Definitions when they have been explicitly configured to be part of the Web API project
For a quick visual of the issue, see the screenshots at the end of this ticket
### Problem This Causes
- It is alarming, and a potential security concern, to find endpoints exposed through your own API without explicit configuration
- In solutions with multiple Web API projects, the DispatchEndPoint and TriggerEndPoint somehow show up in all the Web API projects, not just the Web API projects for the Elsa workflow API
### Reproduction Steps
1. Create a new Web API Project in Visual Studio
2. Run Web API and navigate to the Swagger UI Page (See Screenshot A below)
3. Observer only the Get /WeatherForcast Endpoint
4. Stop Web API, and add Elsa.Activities.Http
- Note: **Do NOT configure any Elsa services** in the startup.cs (or program.cs) file
5. Run Web API and navigate to the Swagger UI page
6. Observe the DispatchEndPoint and TriggerEndPoint (See Screenshot B below)
### Environment
- Windows 10
- Visual Studio 2022
- .Net 6
- Elsa.Activities.Http v2.4.0.1
### Screenshots
**A) --- Vanilla Web API Project ---**

**B) --- Vanilla Web API Project, `Elsa.Activities.Http` Nuget Package references, but **no Elsa configuration** ---**

### Coding Comments
Looking at the source code, I have been unable to see exactly how or why this controller self-registration behavior happens, and am very curious to understand the mechanism by which it occurs. I think maybe the 'Add Features' method is getting executed in the [ElsaOptionsBuilder class](https://github.com/elsa-workflows/elsa-core/blob/f12ad05932cd35fb4dc9a87d81aa4caf89fe316a/src/core/Elsa.Core/Extensions/ElsaOptionBuilderExtensions.cs#L20), but how/why is this method getting excuted?
### Other Comments
Thanks for the great work on this library. I have been looking for an alternative to 'Azure Logic Apps' that is better suited to local and cross-platform development - and this looks like a great fit.
Contributor guide
Assessment
This issue has not been assessed yet.