Update start up

Blazor.BFF.Yarp.CertificateAuth/Server/Program.cs

@@ -1,21 +1,133 @@
-using Microsoft.AspNetCore.Hosting;
+using Blazor.BFF.Yarp.CertificateAuth.Server;
+using Microsoft.AspNetCore.Authentication.Cookies;
+using Microsoft.AspNetCore.Authentication.OpenIdConnect;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Hosting;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
+using Microsoft.IdentityModel.JsonWebTokens;
+using Microsoft.IdentityModel.Logging;
+using Microsoft.IdentityModel.Protocols.OpenIdConnect;
+using Microsoft.IdentityModel.Tokens;
+using NetEscapades.AspNetCore.SecurityHeaders.Infrastructure;
+using System.Net.Security;
+using System.Security.Cryptography.X509Certificates;
 
-namespace Blazor.BFF.Yarp.CertificateAuth.Server;
+var builder = WebApplication.CreateBuilder(args);
 
-public class Program
+builder.WebHost.ConfigureKestrel(serverOptions =>
 {
-    public static void Main(string[] args)
+    serverOptions.AddServerHeader = false;
+});
+
+var services = builder.Services;
+
+services.AddSecurityHeaderPolicies()
+    .SetPolicySelector((PolicySelectorContext ctx) =>
+    {
+        return SecurityHeadersDefinitions.GetHeaderPolicyCollection(
+            builder.Environment.IsDevelopment(),
+            builder.Configuration["OpenIDConnectSettings:Authority"]!);
+    });
+
+services.AddAntiforgery(options =>
+{
+    options.HeaderName = "X-XSRF-TOKEN";
+    options.Cookie.Name = "__Host-X-XSRF-TOKEN";
+    options.Cookie.SameSite = SameSiteMode.Strict;
+    options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
+});
+
+services.AddHttpClient();
+services.AddOptions();
+
+var openIDConnectSettings = builder.Configuration.GetSection("OpenIDConnectSettings");
+
+services.AddAuthentication(options =>
+{
+    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
+    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
+})
+.AddCookie()
+.AddOpenIdConnect(options =>
+{
+    options.SignInScheme = "Cookies";
+    options.Authority = openIDConnectSettings["Authority"];
+    options.ClientId = openIDConnectSettings["ClientId"];
+    options.ClientSecret = openIDConnectSettings["ClientSecret"];
+    options.RequireHttpsMetadata = true;
+    options.ResponseType = OpenIdConnectResponseType.Code;
+    options.UsePkce = true;
+    options.Scope.Add("profile");
+    options.SaveTokens = true;
+    options.GetClaimsFromUserInfoEndpoint = true;
+    options.TokenValidationParameters = new TokenValidationParameters
+    {
+        NameClaimType = "name",
+        RoleClaimType = "role"
+    };
+});
+
+// Create an authorization policy used by YARP when forwarding requests
+// from the WASM application to the Dantooine.Api1 resource server.
+services.AddAuthorization(options => options.AddPolicy("CookieAuthenticationPolicy", builder =>
+{
+    builder.AddAuthenticationSchemes(CookieAuthenticationDefaults.AuthenticationScheme);
+    builder.RequireAuthenticatedUser();
+}));
+
+services.AddControllersWithViews(options =>
+    options.Filters.Add(new AutoValidateAntiforgeryTokenAttribute()));
+
+services.AddRazorPages();
+
+var cert = new X509Certificate2("client.pfx", "1234");
+
+services.AddReverseProxy()
+    .ConfigureHttpClient((context, handler) =>
     {
-        CreateHostBuilder(args).Build().Run();
-    }
-
-    public static IHostBuilder CreateHostBuilder(string[] args) =>
-            Host.CreateDefaultBuilder(args)
-                .ConfigureWebHostDefaults(webBuilder =>
-                {
-                    webBuilder
-                        .ConfigureKestrel(options => options.AddServerHeader = false)
-                        .UseStartup<Startup>();
-                });
+        handler.SslOptions = new SslClientAuthenticationOptions
+        {
+            ClientCertificates = new X509CertificateCollection
+            {
+                cert
+        }
+        };
+    })
+    .LoadFromConfig(builder.Configuration.GetSection("ReverseProxy"));
+
+var app = builder.Build();
+
+JsonWebTokenHandler.DefaultInboundClaimTypeMap.Clear();
+// Do not add to deployments, for debug reasons
+IdentityModelEventSource.ShowPII = true;
+
+if (app.Environment.IsDevelopment())
+{
+    app.UseDeveloperExceptionPage();
+    app.UseWebAssemblyDebugging();
 }
+else
+{
+    app.UseExceptionHandler("/Error");
+}
+
+app.UseSecurityHeaders();
+
+app.UseHttpsRedirection();
+app.UseBlazorFrameworkFiles();
+app.UseStaticFiles();
+
+app.UseRouting();
+app.UseAuthentication();
+app.UseAuthorization();
+
+app.MapRazorPages();
+app.MapControllers();
+app.MapReverseProxy();
+app.MapFallbackToPage("/_Host");
+
+app.Run();