fix(blogs): drop debug MapGet("/identity") claim-dumper
The endpoint was a copy-paste from the IdentityServer template
documentation. It serialised the entire HttpContext.User claim set
to anonymous JSON, with no auth gate. In a public-facing deployment
that's exactly the kind of surface scrapers and botnets love
(it tells them whether their token is valid and what shape the
issuer uses), and it served no production purpose.
Side benefit: removes the ASP0004 analyser warning ("IActionResult
should not be returned from a MapGet Delegate") that came with
this line.
This commit is contained in:
parent
006e05a375
commit
0480e3e3e8
1 changed files with 0 additions and 4 deletions
|
|
@ -91,10 +91,6 @@ internal class Program
|
||||||
app.MapControllers();
|
app.MapControllers();
|
||||||
app.MapIdentityApi<ApplicationUser>().RequireAuthorization("BlogScope");
|
app.MapIdentityApi<ApplicationUser>().RequireAuthorization("BlogScope");
|
||||||
|
|
||||||
app.MapGet("/identity", (HttpContext context) =>
|
|
||||||
new JsonResult(context?.User?.Claims.Select(c => new { c.Type, c.Value }))
|
|
||||||
);
|
|
||||||
|
|
||||||
app.UseSession();
|
app.UseSession();
|
||||||
await app.RunAsync();
|
await app.RunAsync();
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue