---
title: Legacy cookie gate middleware
summary: Presence-only legacy session/auth cookie checks that redirect but never block the pipeline.
status: draft
owner: Framework.NCore maintainers
last_reviewed: 2026-10-02
library: SAIF.NetCore.ServiceExtensions
reference_type: package
operation_id: OP-13
trigger: A request passes through LegacyBolAuthMiddleware or AspNetSessionIdMiddleware.
---

# Legacy cookie gate middleware

This operation describes the shared behavior of `LegacyBolAuthMiddleware` and `AspNetSessionIdMiddleware`: both check for the presence of a legacy cookie and redirect to a configured legacy session endpoint if it is missing, but — critically — both always invoke the rest of the pipeline regardless of the outcome (see [BR-SE-16](../business-rules.md#br-se-16-legacy-cookie-gates-check-presence-only-and-are-fail-open) and [security-authorization.md](../security-authorization.md) for the associated security weakness, findings SEC-01/SEC-02).

| Field | Value |
| --- | --- |
| **Operation ID** | OP-13 |
| **Trigger** | Any request through a pipeline with `LegacyBolAuthMiddleware` or `AspNetSessionIdMiddleware` registered. `LegacyBolAuthMiddleware` is registered by [App startup configure services](app-startup-configure-services.md) but never added to the pipeline (dead code*); `AspNetSessionIdMiddleware` is wired into the pipeline only when `EnableSessionMiddleware` is set (see [BR-SE-17](../business-rules.md#br-se-17-session-support-and-its-gate-are-opt-in)) |
| **Inputs** | The `HttpContext`'s cookie collection. |
| **Outputs** | A 302 redirect response when the cookie is missing; the pipeline always continues. |
| **Primary components** | `LegacyBolAuthMiddleware.InvokeAsync`, `AspNetSessionIdMiddleware.InvokeAsync` |
| **Entry point** | `src/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/Middleware/LegacyBolAuthMiddleware.cs` (L36–47), `AspNetSessionIdMiddleware.cs` (L35–47) |

## Steps

1. Check for cookie **presence** only — `SAIFAUTH`/`SAIF.BOL.Auth` for `LegacyBolAuthMiddleware`, or `ASP.NET_SessionId` for `AspNetSessionIdMiddleware` ([BR-SE-16](../business-rules.md#br-se-16-legacy-cookie-gates-check-presence-only-and-are-fail-open))
   - The cookie's value is never validated — only its existence is checked.
2. If missing: call `GetSettingValueAsync("endpoint", "LegacySessionProvider")` and issue `Response.Redirect(redirectUrl)`, where `redirectUrl` is `$"{context.Request.Scheme}://{context.Request.Host}{endpoint}?returnUrl={Uri.EscapeDataString(originalUrl)}"` ([BR-SE-16](../business-rules.md#br-se-16-legacy-cookie-gates-check-presence-only-and-are-fail-open))

   > **Origin**: Step 2's setting lookup is implemented in [`Get setting value`](../../saif-netcore-environmentclient/operations/get-setting-value.md) (`SAIF.NetCore.EnvironmentClient`) and executed on behalf of this operation.
3. `await next(context)` is invoked **unconditionally**, in both files, regardless of whether the cookie was present ([BR-SE-16](../business-rules.md#br-se-16-legacy-cookie-gates-check-presence-only-and-are-fail-open))
   - This is a fail-open control: the redirect response is issued, but the downstream middleware and endpoint still execute as if the request were authorized*.

## Process flow

This diagram shows the per-request path shared by both `LegacyBolAuthMiddleware` and `AspNetSessionIdMiddleware`, emphasizing that `await next(context)` always runs regardless of the cookie-presence outcome (the fail-open behavior).

```mermaid
flowchart TD
    Start([Request enters middleware]) --> S1{Cookie present?}
    S1 -->|Yes| S3[await next unconditionally]
    S1 -->|No| S2[Look up LegacySessionProvider endpoint and redirect]
    S2 --> S3
    S3 --> EndOk([Pipeline continues regardless of cookie outcome])
```

## Failure and edge-case behavior
- Because `await next(context)` always runs, a missing cookie never actually blocks the request from reaching downstream middleware/endpoints — the redirect is advisory only, which is the fail-open weakness documented as SEC-01/SEC-02 in [security-authorization.md](../security-authorization.md).

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts. Statements marked with `**` could not be confirmed; treat
> as unknown until verified.

## Sources
- `src/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/Middleware/LegacyBolAuthMiddleware.cs`
- `src/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/SAIF.NetCore.ServiceExtensions/Middleware/AspNetSessionIdMiddleware.cs`