Skip to content

Commit c4d6c51

Browse files
guardrexguardrex
authored
Remove insecure endpoint (#514)
1 parent e2e2fe4 commit c4d6c51

File tree

14 files changed

+26
-198
lines changed

14 files changed

+26
-198
lines changed

‎8.0/BlazorWebAppOidcServer/BlazorWebAppOidcServer/Components/Layout/NavMenu.razor

+2-8
Original file line numberDiff line numberDiff line change
@@ -20,18 +20,12 @@
2020
</NavLink>
2121
</div>
2222

23-
<div class="nav-item px-3">
24-
<NavLink class="nav-link" href="weather-insecure">
25-
<span class="bi bi-list-nested-nav-menu" aria-hidden="true"></span> Weather (Insecure)
26-
</NavLink>
27-
</div>
28-
2923
<LogInOrOut />
3024

3125
<AuthorizeView>
3226
<div class="nav-item px-3">
33-
<NavLink class="nav-link" href="weather-secure">
34-
<span class="bi bi-list-nested-nav-menu" aria-hidden="true"></span> Weather (Secure)
27+
<NavLink class="nav-link" href="weather">
28+
<span class="bi bi-list-nested-nav-menu" aria-hidden="true"></span> Weather
3529
</NavLink>
3630
</div>
3731

‎8.0/BlazorWebAppOidcServer/BlazorWebAppOidcServer/Components/Pages/WeatherInsecure.razor renamed to ‎8.0/BlazorWebAppOidcServer/BlazorWebAppOidcServer/Components/Pages/Weather.razor

+6-5
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
1-
@page "/weather-insecure"
1+
@page "/weather"
22
@using Microsoft.AspNetCore.Authorization
3+
@attribute [Authorize]
34
@inject IConfiguration Config
45
@inject IHttpClientFactory ClientFactory
56

6-
<PageTitle>Weather (Insecure)</PageTitle>
7+
<PageTitle>Weather</PageTitle>
78

8-
<h1>Weather (Insecure)</h1>
9+
<h1>Weather</h1>
910

1011
<p>This component demonstrates showing data.</p>
1112

@@ -43,8 +44,8 @@ else
4344

4445
protected override async Task OnInitializedAsync()
4546
{
46-
var request = new HttpRequestMessage(HttpMethod.Get, Config["WeatherForecastInsecureUrl"]);
47-
var client = ClientFactory.CreateClient();
47+
var request = new HttpRequestMessage(HttpMethod.Get, "/weather-forecast");
48+
var client = ClientFactory.CreateClient("ExternalApi");
4849

4950
var response = await client.SendAsync(request);
5051

‎8.0/BlazorWebAppOidcServer/BlazorWebAppOidcServer/Components/Pages/WeatherSecure.razor

-57
This file was deleted.

‎8.0/BlazorWebAppOidcServer/BlazorWebAppOidcServer/Program.cs

+2-2
Original file line numberDiff line numberDiff line change
@@ -141,8 +141,8 @@
141141

142142
builder.Services.AddScoped<TokenHandler>();
143143

144-
builder.Services.AddHttpClient("ExternalAPI",
145-
client => client.BaseAddress = new Uri(builder.Configuration["AppBaseUri"] ??
144+
builder.Services.AddHttpClient("ExternalApi",
145+
client => client.BaseAddress = new Uri(builder.Configuration["ExternalApiUri"] ??
146146
throw new Exception("Missing base address!")))
147147
.AddHttpMessageHandler<TokenHandler>();
148148

‎8.0/BlazorWebAppOidcServer/BlazorWebAppOidcServer/appsettings.json

+1-3
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,5 @@
66
}
77
},
88
"AllowedHosts": "*",
9-
"AppBaseUri": "https://localhost:7296",
10-
"WeatherForecastInsecureUrl": "https://localhost:7277/weather-forecast-insecure",
11-
"WeatherForecastSecureUrl": "https://localhost:7277/weather-forecast-secure"
9+
"ExternalApiUri": "https://localhost:7277"
1210
}

‎8.0/BlazorWebAppOidcServer/MinimalApiJwt/Program.cs

+1-23
Original file line numberDiff line numberDiff line change
@@ -33,12 +33,7 @@
3333
"Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
3434
};
3535

36-
// Secure web API for weather forecast data
37-
// The following MapGet call chains a call to
38-
// RequireAuthorization. This endpoint only
39-
// returns data when a user is signed into the
40-
// app.
41-
app.MapGet("/weather-forecast-secure", () =>
36+
app.MapGet("/weather-forecast", () =>
4237
{
4338
var forecast = Enumerable.Range(1, 5).Select(index =>
4439
new WeatherForecast
@@ -51,23 +46,6 @@
5146
return forecast;
5247
}).RequireAuthorization();
5348

54-
// Insecure web API for weather forebase data
55-
// The following MapGet call doesn't chain a call to
56-
// RequireAuthorization. This endpoint returns data
57-
// when a user isn't signed into the app.
58-
app.MapGet("/weather-forecast-insecure", () =>
59-
{
60-
var forecast = Enumerable.Range(1, 5).Select(index =>
61-
new WeatherForecast
62-
(
63-
DateOnly.FromDateTime(DateTime.Now.AddDays(index)),
64-
Random.Shared.Next(-20, 55),
65-
summaries[Random.Shared.Next(summaries.Length)]
66-
))
67-
.ToArray();
68-
return forecast;
69-
});
70-
7149
app.Run();
7250

7351
internal record WeatherForecast(DateOnly Date, int TemperatureC, string? Summary)

‎8.0/BlazorWebAppOidcServer/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ This sample features:
55
* A Blazor Web App with global Server interactivity.
66
* OIDC authentication with Microsoft Entra without using Entra-specific packages. This sample can be used as a starting point for any OIDC authentication flow.
77
* Automatic non-interactive token refresh with the help of a custom `CookieOidcRefresher`.
8-
* Both secure and insecure web API calls for weather data to a separate web API project. The access token is obtained from the server-side `HttpContext` and attached to outgoing requests with a `DelegatingHandler` service.
8+
* Secure web API call for weather data to a separate web API project. The access token is obtained from the server-side `HttpContext` and attached to outgoing requests with a `DelegatingHandler` service.
99

1010
## Article for this sample app
1111

‎9.0/BlazorWebAppOidcServer/BlazorWebAppOidcServer/Components/Layout/NavMenu.razor

+2-8
Original file line numberDiff line numberDiff line change
@@ -20,18 +20,12 @@
2020
</NavLink>
2121
</div>
2222

23-
<div class="nav-item px-3">
24-
<NavLink class="nav-link" href="weather-insecure">
25-
<span class="bi bi-list-nested-nav-menu" aria-hidden="true"></span> Weather (Insecure)
26-
</NavLink>
27-
</div>
28-
2923
<LogInOrOut />
3024

3125
<AuthorizeView>
3226
<div class="nav-item px-3">
33-
<NavLink class="nav-link" href="weather-secure">
34-
<span class="bi bi-list-nested-nav-menu" aria-hidden="true"></span> Weather (Secure)
27+
<NavLink class="nav-link" href="weather">
28+
<span class="bi bi-list-nested-nav-menu" aria-hidden="true"></span> Weather
3529
</NavLink>
3630
</div>
3731

‎9.0/BlazorWebAppOidcServer/BlazorWebAppOidcServer/Components/Pages/WeatherInsecure.razor renamed to ‎9.0/BlazorWebAppOidcServer/BlazorWebAppOidcServer/Components/Pages/Weather.razor

+6-5
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
1-
@page "/weather-insecure"
1+
@page "/weather"
22
@using Microsoft.AspNetCore.Authorization
3+
@attribute [Authorize]
34
@inject IConfiguration Config
45
@inject IHttpClientFactory ClientFactory
56

6-
<PageTitle>Weather (Insecure)</PageTitle>
7+
<PageTitle>Weather</PageTitle>
78

8-
<h1>Weather (Insecure)</h1>
9+
<h1>Weather</h1>
910

1011
<p>This component demonstrates showing data.</p>
1112

@@ -43,8 +44,8 @@ else
4344

4445
protected override async Task OnInitializedAsync()
4546
{
46-
var request = new HttpRequestMessage(HttpMethod.Get, Config["WeatherForecastInsecureUrl"]);
47-
var client = ClientFactory.CreateClient();
47+
var request = new HttpRequestMessage(HttpMethod.Get, "/weather-forecast");
48+
var client = ClientFactory.CreateClient("ExternalApi");
4849

4950
var response = await client.SendAsync(request);
5051

‎9.0/BlazorWebAppOidcServer/BlazorWebAppOidcServer/Components/Pages/WeatherSecure.razor

-57
This file was deleted.

‎9.0/BlazorWebAppOidcServer/BlazorWebAppOidcServer/Program.cs

+2-2
Original file line numberDiff line numberDiff line change
@@ -154,8 +154,8 @@
154154

155155
builder.Services.AddScoped<TokenHandler>();
156156

157-
builder.Services.AddHttpClient("ExternalAPI",
158-
client => client.BaseAddress = new Uri(builder.Configuration["AppBaseUri"] ??
157+
builder.Services.AddHttpClient("ExternalApi",
158+
client => client.BaseAddress = new Uri(builder.Configuration["ExternalApiUri"] ??
159159
throw new Exception("Missing base address!")))
160160
.AddHttpMessageHandler<TokenHandler>();
161161

‎9.0/BlazorWebAppOidcServer/BlazorWebAppOidcServer/appsettings.json

+1-3
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,5 @@
66
}
77
},
88
"AllowedHosts": "*",
9-
"AppBaseUri": "https://localhost:7296",
10-
"WeatherForecastInsecureUrl": "https://localhost:7277/weather-forecast-insecure",
11-
"WeatherForecastSecureUrl": "https://localhost:7277/weather-forecast-secure"
9+
"ExternalApiUri": "https://localhost:7277"
1210
}

‎9.0/BlazorWebAppOidcServer/MinimalApiJwt/Program.cs

+1-23
Original file line numberDiff line numberDiff line change
@@ -33,12 +33,7 @@
3333
"Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
3434
};
3535

36-
// Secure web API for weather forecast data
37-
// The following MapGet call chains a call to
38-
// RequireAuthorization. This endpoint only
39-
// returns data when a user is signed into the
40-
// app.
41-
app.MapGet("/weather-forecast-secure", () =>
36+
app.MapGet("/weather-forecast", () =>
4237
{
4338
var forecast = Enumerable.Range(1, 5).Select(index =>
4439
new WeatherForecast
@@ -51,23 +46,6 @@
5146
return forecast;
5247
}).RequireAuthorization();
5348

54-
// Insecure web API for weather forebase data
55-
// The following MapGet call doesn't chain a call to
56-
// RequireAuthorization. This endpoint returns data
57-
// when a user isn't signed into the app.
58-
app.MapGet("/weather-forecast-insecure", () =>
59-
{
60-
var forecast = Enumerable.Range(1, 5).Select(index =>
61-
new WeatherForecast
62-
(
63-
DateOnly.FromDateTime(DateTime.Now.AddDays(index)),
64-
Random.Shared.Next(-20, 55),
65-
summaries[Random.Shared.Next(summaries.Length)]
66-
))
67-
.ToArray();
68-
return forecast;
69-
});
70-
7149
app.Run();
7250

7351
internal record WeatherForecast(DateOnly Date, int TemperatureC, string? Summary)

‎9.0/BlazorWebAppOidcServer/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ This sample features:
55
* A Blazor Web App with global Server interactivity.
66
* OIDC authentication with Microsoft Entra without using Entra-specific packages. This sample can be used as a starting point for any OIDC authentication flow.
77
* Automatic non-interactive token refresh with the help of a custom `CookieOidcRefresher`.
8-
* Both secure and insecure web API calls for weather data to a separate web API project. The access token is obtained from the server-side `HttpContext` and attached to outgoing requests with a `DelegatingHandler` service.
8+
* Secure web API call for weather data to a separate web API project. The access token is obtained from the server-side `HttpContext` and attached to outgoing requests with a `DelegatingHandler` service.
99

1010
## Article for this sample app
1111

0 commit comments

Comments
 (0)