Skip to content

Add new security header and update dependencies #26

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rufer7 merged 6 commits into from
Jun 24, 2026
Merged

Add new security header and update dependencies #26

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
a82d5e8
Update NuGet packages
rufer7 Jun 24, 2026
2e49bd3
Ensure dependency locking
rufer7 Jun 24, 2026
fa6bf8c
Add Clear-Site-Data response header on logout
rufer7 Jun 24, 2026
b5b1d10
Add Clear-Site-Data response header on logout
rufer7 Jun 24, 2026
9f979a7
Apply suggestion from @rufer7
rufer7 Jun 24, 2026
f8920cc
minor
rufer7 Jun 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/deploy-to-azure.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ jobs:

- name: npm setup
working-directory: ui
run: npm install --force --ignore-scripts
run: npm install --frozen-lockfile --force --ignore-scripts

- name: ui-angular-cli-build
working-directory: ui
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/dotnet-and-npm-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:

- name: npm setup
working-directory: ui
run: npm install --force --ignore-scripts
run: npm install --frozen-lockfile --force --ignore-scripts

- name: ui-angular-cli-build
working-directory: ui
Expand Down
4 changes: 2 additions & 2 deletions Bff.AppHost/Bff.AppHost.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,8 @@
</PropertyGroup>

<ItemGroup>
<PackageReference Include="Aspire.Hosting.AppHost" Version="13.3.3" />
<PackageReference Include="Aspire.Hosting.JavaScript" Version="13.3.3" />
<PackageReference Include="Aspire.Hosting.AppHost" Version="13.4.6" />
<PackageReference Include="Aspire.Hosting.JavaScript" Version="13.4.6" />
</ItemGroup>

<ItemGroup>
Expand Down
8 changes: 4 additions & 4 deletions Bff.ServiceDefaults/Bff.ServiceDefaults.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,10 @@
<ItemGroup>
<FrameworkReference Include="Microsoft.AspNetCore.App" />

<PackageReference Include="Microsoft.Extensions.Http.Resilience" Version="10.6.0" />
<PackageReference Include="Microsoft.Extensions.ServiceDiscovery" Version="10.6.0" />
<PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.15.3" />
<PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.15.3" />
<PackageReference Include="Microsoft.Extensions.Http.Resilience" Version="10.7.0" />
<PackageReference Include="Microsoft.Extensions.ServiceDiscovery" Version="10.7.0" />
<PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.16.0" />
<PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.16.0" />
<PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.15.2" />
<PackageReference Include="OpenTelemetry.Instrumentation.Http" Version="1.15.1" />
<PackageReference Include="OpenTelemetry.Instrumentation.Runtime" Version="1.15.1" />
Expand Down
3 changes: 2 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ For local development environment setup proceed as follows:

1. Check out the repository
1. Install Angular CLI latest globally `npm install -g @angular/cli latest`
1. Open `Bff.sln` in Visual Studio 2022 or later
1. Open `Bff.sln` in Visual Studio 2026 or later
1. Set `Bff.AppHost` as startup project
1. Run the project (F5)
1. Open URL of `bffmicrosoftentraid-server` from the Aspire dashboard (usually `https://localhost:5001`)
Expand Down Expand Up @@ -88,6 +88,7 @@ ng update @angular/cli @angular/core

## History

- 2026-06-24 Updated NuGet packages, added new security headers
- 2026-05-16 Updated NuGet packages, updated Angular to 21.2.0
- 2026-03-18 Updated .NET Aspire to 13.1.2, updated xunit to xunit.v3, moved permissions from workflow level to job level, updated npm packages
- 2026-03-14 Updated Nuget packages
Expand Down
12 changes: 6 additions & 6 deletions server/BffMicrosoftEntraID.Server.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,12 +21,12 @@
</ItemGroup>

<ItemGroup>
<PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="10.0.8" NoWarn="NU1605" />
<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="10.0.8" />
<PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.8" />
<PackageReference Include="Microsoft.Identity.Web.GraphServiceClient" Version="4.9.0" />
<PackageReference Include="Microsoft.Identity.Web" Version="4.9.0" />
<PackageReference Include="Microsoft.Identity.Web.UI" Version="4.9.0" />
<PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="10.0.9" NoWarn="NU1605" />
<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="10.0.9" />
<PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.9" />
<PackageReference Include="Microsoft.Identity.Web.GraphServiceClient" Version="4.11.0" />
<PackageReference Include="Microsoft.Identity.Web" Version="4.11.0" />
<PackageReference Include="Microsoft.Identity.Web.UI" Version="4.11.0" />
<PackageReference Include="NetEscapades.AspNetCore.SecurityHeaders" Version="1.3.1" />
<PackageReference Include="NetEscapades.AspNetCore.SecurityHeaders.TagHelpers" Version="1.3.1" />
<PackageReference Include="Yarp.ReverseProxy" Version="2.3.0" />
Expand Down
1 change: 1 addition & 0 deletions server/Controllers/AccountController.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ public ActionResult Login(string? returnUrl, string? claimsChallenge)
[HttpPost("Logout")]
public IActionResult Logout()
{
Response.Headers.Append("Clear-Site-Data", "\"cache\", \"cookies\"");
return SignOut(
new AuthenticationProperties { RedirectUri = "/" },
CookieAuthenticationDefaults.AuthenticationScheme,
Expand Down
6 changes: 3 additions & 3 deletions tests/BffMicrosoftEntraID.Server.IntegrationTests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,12 +8,12 @@
</PropertyGroup>

<ItemGroup>
<PackageReference Include="coverlet.collector" Version="10.0.0">
<PackageReference Include="coverlet.collector" Version="10.0.1">
<PrivateAssets>all</PrivateAssets>
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
</PackageReference>
<PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.8" />
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.5.1" />
<PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.9" />
<PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
<PackageReference Include="xunit.v3" Version="3.2.2" />
<PackageReference Include="xunit.runner.visualstudio" Version="3.1.5">
<PrivateAssets>all</PrivateAssets>
Expand Down
Loading