8 Application security in Aspire
This chapter covers
- Understanding the fundamentals of application security
- Getting an overview of single sign-on
- Implementing OpenID Connect authentication in Aspire
- Using OAuth authorization in Aspire
- Securing the Aspire dashboard
We briefly viewed application security in chapter 2 by adding a Keycloak container to an Aspire instance. In this chapter, we’ll delve deeper into application security concepts. We’ll enforce authentication and authorization end to end so that they apply when the user interacts with the UI and when the frontend interacts with the backend API.
If you publish a web application and make it publicly accessible, you’ll want to make sure that only authorized users can access it—unless, of course, your application is a trivial website. Applications orchestrated by Aspire are no exceptions. Because Aspire is a platform for building complex distributed applications, chances are that you aren’t using it to build trivial websites. Therefore, knowing how to secure your orchestrated application is a must.