fix(blogs): drop debug MapGet("/identity") claim-dumper

The endpoint was a copy-paste from the IdentityServer template
documentation. It serialised the entire HttpContext.User claim set
to anonymous JSON, with no auth gate. In a public-facing deployment
that's exactly the kind of surface scrapers and botnets love
(it tells them whether their token is valid and what shape the
issuer uses), and it served no production purpose.

Side benefit: removes the ASP0004 analyser warning ("IActionResult
should not be returned from a MapGet Delegate") that came with
this line.
This commit is contained in:
Paul Schneider 2026-07-07 22:13:29 +01:00
commit 0480e3e3e8

View file

@ -91,10 +91,6 @@ internal class Program
app.MapControllers();
app.MapIdentityApi<ApplicationUser>().RequireAuthorization("BlogScope");
app.MapGet("/identity", (HttpContext context) =>
new JsonResult(context?.User?.Claims.Select(c => new { c.Type, c.Value }))
);
app.UseSession();
await app.RunAsync();
}