How to secure the /_features endpoint?

[sturlath]

How to secure the /_features endpoint?

[sturlath]

So no recommendation on how to do this?

[kendaleiv]

That is an excellent question. @billbogaiv implemented something like this:

.UseWhen(
    predicate: x =>
    {
        return
        x.Request.Path.StartsWithSegments(featureFlagsOptions.ApiGetAllPath) ||
        x.Request.Path.StartsWithSegments(featureFlagsOptions.ApiGetPath) ||
        x.Request.Path.StartsWithSegments(featureFlagsOptions.ApiSetPath) ||
        x.Request.Path.StartsWithSegments(featureFlagsOptions.UiPath);
    },
    configuration: x =>
    {
        // Custom authorization code, for example:
        x.UseAuthorization(OpenIdConnectDefaults.AuthenticationScheme);
    })

I'd like to see something cleaner in the future, but maybe this helps for the moment?

[billbogaiv]

Some additional things you'll need (assuming < .NET Core 3):

/// <summary>
/// Consider removing once .NET Core 3.0 is stable => relies on EndpointRouting to work.
/// Ref. https://github.com/aspnet/AspNetCore/blob/v3.0.0-preview3-19153-02/src/Security/Authorization/Policy/src/AuthorizationAppBuilderExtensions.cs
/// </summary>
public static class AuthorizationAppBuilderExtensions
{
    public static IApplicationBuilder UseAuthorization(
        this IApplicationBuilder app,
        string policyName)
    {
        if (string.IsNullOrEmpty(policyName))
        {
            throw new ArgumentNullException(nameof(policyName));
        }

        return app.UseMiddleware<AuthorizationMiddleware>(policyName);
    }
}

and

/// <summary>
/// Consider removing once .NET Core 3.0 is stable => relies on EndpointRouting to work.
/// Ref. https://github.com/aspnet/AspNetCore/blob/v3.0.0-preview3-19153-02/src/Security/Authorization/Policy/src/AuthorizationMiddleware.cs.
/// </summary>
public class AuthorizationMiddleware
{
    public AuthorizationMiddleware(
        RequestDelegate next,
        string policyName)
    {
        this.next = next;
        this.policyName = policyName;
    }

    private readonly RequestDelegate next;
    private readonly string policyName;

    public async Task Invoke(
        HttpContext httpContext,
        IAuthorizationService authorizationService)
    {
        AuthorizationResult authorizationResult =
            await authorizationService.AuthorizeAsync(httpContext.User, null, policyName);

        if (!httpContext.User.Identity.IsAuthenticated && !authorizationResult.Succeeded)
        {
            await httpContext.ChallengeAsync();

            return;
        }
        else if (httpContext.User.Identity.IsAuthenticated && !authorizationResult.Succeeded)
        {
            await httpContext.ForbidAsync();

            return;
        }

        await next(httpContext);
    }
}