How to secure healtchecks in ASP.NET Core?

Question

I am including the following nuget package: AspNetCore.Diagnostics.HealthChecks with the HealthChecks.UI part to graphically display the status of the configured services.

Is there anything already implemented to add security to it, so that cannot be displayed without security?

Answer 1

Health checks use the authentication and authorization mechanisms used for endpoint routing. The Health Checks guide explains how to use authorization with RequiresAuthorization , eg :

app.UseEndpoints(endpoints =>
{
    endpoints.MapHealthChecks("/health").RequireAuthorization();
});

The default policy requires authentication only. The Authorization for specific endpoints section shows how to create custom authorization policies, and specify them by name, or by passing the policy name.

The last example, is probably more interesting :

app.UseEndpoints(endpoints =>
{
    endpoints
        .MapHealthChecks("/healthz")
        .RequireAuthorization(new AuthorizeAttribute(){ Roles = "admin", });
});

The AuthorizeAttribute attribute implements IAuthorizeData , the interface implemented by all authorization policies.