From 0480e3e3e8a80e58c8e33f320d1f6f840d05398d Mon Sep 17 00:00:00 2001 From: Paul Schneider Date: Tue, 7 Jul 2026 22:13:29 +0100 Subject: [PATCH] fix(blogs): drop debug MapGet("/identity") claim-dumper The endpoint was a copy-paste from the IdentityServer template documentation. It serialised the entire HttpContext.User claim set to anonymous JSON, with no auth gate. In a public-facing deployment that's exactly the kind of surface scrapers and botnets love (it tells them whether their token is valid and what shape the issuer uses), and it served no production purpose. Side benefit: removes the ASP0004 analyser warning ("IActionResult should not be returned from a MapGet Delegate") that came with this line. --- src/Yavsc.Blogs/Program.cs | 4 ---- 1 file changed, 4 deletions(-) diff --git a/src/Yavsc.Blogs/Program.cs b/src/Yavsc.Blogs/Program.cs index b338e1cb..4a819d3a 100644 --- a/src/Yavsc.Blogs/Program.cs +++ b/src/Yavsc.Blogs/Program.cs @@ -91,10 +91,6 @@ internal class Program app.MapControllers(); app.MapIdentityApi().RequireAuthorization("BlogScope"); - app.MapGet("/identity", (HttpContext context) => - new JsonResult(context?.User?.Claims.Select(c => new { c.Type, c.Value })) - ); - app.UseSession(); await app.RunAsync(); }