From 59d5dbd0688dad1b56184f389ccbffe56032ad80 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sun, 11 Oct 2026 00:11:01 +0200 Subject: [PATCH] Vote page: gate in the page filter's execution stage (the selected stage has no Result) Co-Authored-By: Claude Opus 5.5 --- src/Bifrost.Web/Pages/Mill/Vote.cshtml.cs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/Bifrost.Web/Pages/Mill/Vote.cshtml.cs b/src/Bifrost.Web/Pages/Mill/Vote.cshtml.cs index b25eec9..5912225 100644 --- a/src/Bifrost.Web/Pages/Mill/Vote.cshtml.cs +++ b/src/Bifrost.Web/Pages/Mill/Vote.cshtml.cs @@ -28,7 +28,7 @@ public sealed class VoteModel( // The single gate before any handler runs. A request that selects no handler (a POST with no or an unknown handler, // any other method) is a client error, never a view over a null subject. A cast is accepted only from the site's own // origin (CastRequestGuard); no antiforgery cookie or token exists on this flow. - public override void OnPageHandlerSelected(PageHandlerSelectedContext context) + public override async Task OnPageHandlerExecutionAsync(PageHandlerExecutingContext context, PageHandlerExecutionDelegate next) { var method = context.HttpContext.Request.Method; if (context.HandlerMethod is null) @@ -43,7 +43,10 @@ public sealed class VoteModel( if (HttpMethods.IsPost(method) && !CastRequestGuard.Allows(context.HttpContext.Request, host.Value)) { context.Result = new StatusCodeResult(StatusCodes.Status403Forbidden); + return; } + + await next(); } public async Task OnGetAsync(string collection, string key, CancellationToken cancellationToken)