postIt #2
1 changed files with 0 additions and 4 deletions
fix(blogs): drop debug MapGet("/identity") claim-dumper
The endpoint was a copy-paste from the IdentityServer template
documentation. It serialised the entire HttpContext.User claim set
to anonymous JSON, with no auth gate. In a public-facing deployment
that's exactly the kind of surface scrapers and botnets love
(it tells them whether their token is valid and what shape the
issuer uses), and it served no production purpose.
Side benefit: removes the ASP0004 analyser warning ("IActionResult
should not be returned from a MapGet Delegate") that came with
this line.
commit
0480e3e3e8
|
|
@ -91,10 +91,6 @@ internal class Program
|
|||
app.MapControllers();
|
||||
app.MapIdentityApi<ApplicationUser>().RequireAuthorization("BlogScope");
|
||||
|
||||
app.MapGet("/identity", (HttpContext context) =>
|
||||
new JsonResult(context?.User?.Claims.Select(c => new { c.Type, c.Value }))
|
||||
);
|
||||
|
||||
app.UseSession();
|
||||
await app.RunAsync();
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue