postIt #2

Merged
notazof merged 27 commits from postIt into main 2026-07-11 02:57:29 +01:00
Showing only changes of commit 0480e3e3e8 - Show all commits

fix(blogs): drop debug MapGet("/identity") claim-dumper

The endpoint was a copy-paste from the IdentityServer template
documentation. It serialised the entire HttpContext.User claim set
to anonymous JSON, with no auth gate. In a public-facing deployment
that's exactly the kind of surface scrapers and botnets love
(it tells them whether their token is valid and what shape the
issuer uses), and it served no production purpose.

Side benefit: removes the ASP0004 analyser warning ("IActionResult
should not be returned from a MapGet Delegate") that came with
this line.
Paul Schneider 2026-07-07 22:13:29 +01:00

View file

@ -91,10 +91,6 @@ internal class Program
app.MapControllers();
app.MapIdentityApi<ApplicationUser>().RequireAuthorization("BlogScope");
app.MapGet("/identity", (HttpContext context) =>
new JsonResult(context?.User?.Claims.Select(c => new { c.Type, c.Value }))
);
app.UseSession();
await app.RunAsync();
}