Paul Schneider
dcf2a93ad0
The Site:Audience setting was conflating two distinct concepts: an OAuth JWT audience (a single resource identifier) and a CORS allow-list (an array of origins). Collapsing them caused several latent bugs: - OAuth/JWT validation expected a single string while CORS WithOrigins accepts an array. - Password-reset callback URLs and OAuth client RedirectUri/Origin were being built from what was meant to be an audience identifier, not a base URL. - Yavsc.Org's main CORS policy was hardcoded to '*', with no way to restrict it without code changes. Changes: - SiteSettings.Audience (string) replaced with CorsAllowedOrigins (IList<string>). - OAuth JWT Authority still reads Site:Authority; Audience now reads Site:ExternalUrl (Org only; Api/Blogs use ValidateAudience=false). - MailSender and AccountController build reset-callback URLs from Site:ExternalUrl. - ClientController uses Site:ExternalUrl for OAuth RedirectUri/Origin defaults on newly created clients. - Yavsc.Api and Yavsc.Blogs now read CORS origins from Site:CorsAllowedOrigins instead of hardcoded URLs. Add shared AddYavscCors / AddYavscJwtBearer extension methods in Yavsc.Server/Helpers/ServiceExtensions.cs to enforce a single configuration contract across all runtime services (Api, Blogs, Org). Fails closed when CorsAllowedOrigins is empty; fails fast at startup when Site:Authority is missing. Remove obsolete ConfigurationHelpers.GetAudience (no remaining callers). Local appsettings-*.json files (which carry deployment-specific values and are gitignored) must be updated to add Site:CorsAllowedOrigins.
67 lines
1.7 KiB
JSON
67 lines
1.7 KiB
JSON
{
|
|
"Site": {
|
|
"Authority": "https://mercure.pschneider.fr",
|
|
"Title": "Yavsc dev",
|
|
"Slogan": "Yavsc : WIP.",
|
|
"Banner": "/images/yavsc.png",
|
|
"HomeViewName": "Home",
|
|
"FavIcon": "/favicon.ico",
|
|
"Icon": "/images/yavsc.png",
|
|
"GitRepository": "testingrepo",
|
|
"Owner": {
|
|
"Name": "Site Owner Name",
|
|
"EMail": "your@email",
|
|
"PostalAddress": {
|
|
"Street1": "Your Address",
|
|
"Street2": "your street",
|
|
"PostalCode": "543 21~3",
|
|
"City": "",
|
|
"State": "",
|
|
"Province": null
|
|
}
|
|
},
|
|
"Admin": {
|
|
"Name": "Administrator name",
|
|
"EMail": "daAdmin@e.mail"
|
|
}
|
|
},
|
|
"Smtp": {
|
|
"Server": "localhost",
|
|
"Port": 465
|
|
},
|
|
"Logging": {
|
|
"IncludeScopes": {},
|
|
"LogLevel": {
|
|
"Default": "Debug",
|
|
"System": "Warning",
|
|
"Microsoft": "Warning"
|
|
}
|
|
},
|
|
"ConnectionStrings": {
|
|
"YavscConnection": "InMemory"
|
|
},
|
|
"DataProtection": {
|
|
"Keys": {
|
|
"Dir": "DataProtection-Keys"
|
|
},
|
|
"RSAParamFile": "RSA-Params.json",
|
|
"ExpiresInHours": 168
|
|
},
|
|
"ApiKey": "lame-key",
|
|
"Testing": {
|
|
"ConnectionStrings": {
|
|
"Default": "lame-default-connection-string",
|
|
"DatabaseCtor": "lame-database-ctor-connection-string"
|
|
},
|
|
"YavscWebPath": "../../src/Yavsc",
|
|
"ValidCreds": {
|
|
"UserName": "lame-user",
|
|
"Password": "lame-password"
|
|
},
|
|
"InvalidCreds": {
|
|
"UserName": "fakeuser",
|
|
"Password": "f/\\kePassw0rd"
|
|
}
|
|
}
|
|
|
|
}
|