From 8af3d6c9ef004fc305d01f1976f13c057f7d006f Mon Sep 17 00:00:00 2001 From: Paul Schneider Date: Tue, 7 Jul 2026 22:13:29 +0100 Subject: [PATCH] fix(blogs): drop debug MapGet("/identity") claim-dumper The endpoint was a copy-paste from the IdentityServer template documentation. It serialised the entire HttpContext.User claim set to anonymous JSON, with no auth gate. In a public-facing deployment that's exactly the kind of surface scrapers and botnets love (it tells them whether their token is valid and what shape the issuer uses), and it served no production purpose. Side benefit: removes the ASP0004 analyser warning ("IActionResult should not be returned from a MapGet Delegate") that came with this line. --- src/Yavsc.Blogs/Program.cs | 4 ---- 1 file changed, 4 deletions(-) diff --git a/src/Yavsc.Blogs/Program.cs b/src/Yavsc.Blogs/Program.cs index b338e1cbb..4a819d3ad 100644 --- a/src/Yavsc.Blogs/Program.cs +++ b/src/Yavsc.Blogs/Program.cs @@ -91,10 +91,6 @@ internal class Program app.MapControllers(); app.MapIdentityApi().RequireAuthorization("BlogScope"); - app.MapGet("/identity", (HttpContext context) => - new JsonResult(context?.User?.Claims.Select(c => new { c.Type, c.Value })) - ); - app.UseSession(); await app.RunAsync(); }