结合IdentityServer4和MVC客户端

Question

I downloaded the sample IdentityServer and MVC client project from Github. My goal is to create a portal environment, in which a user can authenticate and than proceed to request protected resources.

So what I did is move the Views from the MVC client to the IdentityServer project, changed the Client.cs to support a client on the same port and added the following in the startup from the IdentityServer:

        var oidcOptions = new OpenIdConnectOptions
        {
            AuthenticationScheme = "oidc",
            SignInScheme = "Cookies",

            Authority = "http://localhost:5000",
            RequireHttpsMetadata = false,
            PostLogoutRedirectUri = "http://localhost:5000/",
            ClientId = "mvc",
            ClientSecret = "secret",
            ResponseType = "code id_token",
            GetClaimsFromUserInfoEndpoint = true,
            SaveTokens = true
        };

My question is are there any reasons, concerning security, I should not implement this and keep it seperated?

Answer 1

There is nothing wrong with this at all from a security perspective.

However I must warn you that you may run into a problem when dealing with cookies and tokens. Running them in separate projects implicitly separates the concerns of the MVC and IDS projects.

something that you might want to do is to fork your request pipeline by using app.Map() . (eg map IDS to "/identity" and the MVC project to "/ui")