Commented Issue: CORS AttributeBasedPolicyProviderFactory provides incomplete context [1286]

When AttributeBasedPolicyProviderFactory provides an HttpControllerContext, it does not include a controller instance, unlike all other controller contexts. Consumers can expect this invariant elsewhere. The class is using the unit test-only constructor for HttpControllerContext.

Also, the request context used (when no request context is present on the request) doesn't have all properties set, including ClientCertificate, IsLocal and IncludeErrorDetail. Consider using RequestBackedHttpRequestContext instead.

Comments: Fixed in changeset 9aa310ccffe2e24eabc3d0adb2da221c55baef97