ASP.NET

Steve Naidamast wrote:

There is no allowance for pre-made components such as is found with WebForms to easily work with the front-end and middle-tiers of such an application, unless you consider the mass of JavaScript comprised components that currently make up the MVC front-end arena.

@Html.TextBoxFor(...)

@Html.LoginForm()

Steve Naidamast wrote:

The idea that was promoted in one of the replies here that developers should have a greater understanding of how the Internet works in order to develop better applications is complete nonsense. That is not our job as software engineers and developers. Our job is to develop quality applications; not worry about what is going on underneath the hood as they say.

Steve Naidamast wrote:

I am finding that people who promote the ASP.NET MVC style of development appear not to have been exposed to its drastic limitations when under stress with the development large-scale, complex, database, intensive applications.

Steve Naidamast wrote:

First, you are not being asked to become a surgeon so your analogy is not very relevant

Steve Naidamast wrote:

Second, why should I have to bother writing HTML extensions when that is taking time away from my core development endeavor, which is completing an application?

Steve Naidamast wrote:

Your contention is that we have to completely upend our thinking in order to develop with ASP.NET MVC. Why?

Steve Naidamast wrote:

CMS systems are not database intensive systems such as what is found in the financial industry where I worked for over 20 years in my career

Steve Naidamast wrote:

And your experience in no way outpaces mine as I have done as much if not more than you have across three distinct eras in the Information Technology profession.

Steve Naidamast wrote:

I can understand that as I watched one engineer develop an entire JavaScript Treeview control from scratch instead of using one of the available components

Lot of coders wasting time, developing open source/free software. Few, if any, gain enough market share, leading to lot of ‘dead’, useless, buggy or poorly documented products; making web developers life difficult.

Steve Naidamast wrote:

Maybe you are privileged to work in a company or companies where quality software design takes precedence over deadlines and the like but I never have

Steve Naidamast wrote:

If it can't be figured out in 20 minutes it is not worth the effort.

Quote:

... if you encrypt your Config file, then your machine would store your keys and if you copy the Config file to a different system and try to decrypt it, then you might get an error.

services.AddAuthorization(auth =>
{
  auth.AddPolicy(AuthPolicies.Admin, AuthPolicies.AdminPolicy());
  auth.AddPolicy(AuthPolicies.Account, AuthPolicies.AccountPolicy());                            
});

// Add all authentication schemes at once
services.AddAuthentication(option =>
{
    option.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    option.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;

})
.AddIdentityServerJwt()
.AddCookie(option => option.SlidingExpiration = true)<br />
.AddGoogle(CertificateAuthenticationDefaults.AuthenticationScheme, option =>
{
    var googleAuthNSection = Config.GetSection("Authentication:Google");<br />
    option.ClientId = googleAuthNSection["ClientId"];
    option.ClientSecret = googleAuthNSection["ClientSecret"];
})
.AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
{
    var settings = Config.GetSection("Settings");
    var secretKey = settings.GetValue<string>("Auth0:Secret");
    var authority = settings.GetValue<string>("Auth0:Authority");
    var audience = settings.GetValue<string>("Auth0:Audience");
    var issuer = settings.GetValue<string>("Auth0:Issuer");
    var expiresDays = settings.GetValue<int>("Auth0:ExpireDays");
    var signingKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(secretKey));

    options.Audience = audience;
    options.Authority = authority;<br />
    options.SaveToken = false;
    options.RequireHttpsMetadata = false;
    options.Configuration = new OpenIdConnectConfiguration();<br />
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ClockSkew = TimeSpan.FromMinutes(0),
        ValidateIssuerSigningKey = false,
        ValidateIssuer = false,
        ValidateAudience = false,
        ValidateLifetime = false,
        ValidIssuer = issuer,
        ValidAudience = audience,<br />
        IssuerSigningKey = signingKey
    };

    options.Events = new JwtBearerEvents
    {
        OnAuthenticationFailed = context =>
        {
            if (context.Exception.GetType() == typeof(SecurityTokenExpiredException))
            {
                context.Response.Headers.Add("Token-Expired", "true");
            }
            return Task.CompletedTask;
        }                    
    };
    services.AddCors();
});

public class AuthPolicies
{
    public const string Admin = "Admin";
    public const string Account = "Account";

    public static AuthorizationPolicy AdminPolicy()
    {
        return new AuthorizationPolicyBuilder()
            .AddAuthenticationSchemes("Cookies", "Bearer")
            .RequireAuthenticatedUser()
            .RequireRole(Admin)
            .RequireClaim("jti", "sub", "unique_name", "role", "idpId")<br />
            .Build();
    }

    public static AuthorizationPolicy AccountPolicy()
    {
        return new AuthorizationPolicyBuilder()
            .AddAuthenticationSchemes("Cookies", "Bearer")
            .RequireAuthenticatedUser()
            .RequireRole(Account)
            .RequireClaim("jti", "sub", "unique_name", "role", "idpId")<br />
            .Build();
    }

}

public static AuthorizationPolicy AdminPolicy()
{
    return new AuthorizationPolicyBuilder()
        .AddAuthenticationSchemes("Bearer")
        .RequireAuthenticatedUser()
        .RequireRole(Admin)                
        .RequireClaim("jti") 
        //.RequireClaim("bsonId")
        //.RequireClaim("role")
        //.RequireClaim("idpId")
        .Build();
}

public static AuthorizationPolicy AccountPolicy()
{
    return new AuthorizationPolicyBuilder()
        .AddAuthenticationSchemes("Bearer")
        .RequireAuthenticatedUser()
        .RequireRole(Account)
        .RequireClaim("jti", "sub", "unique_name", "role", "bsonId", "idpId")
        .Build();
}