Merge pull request #9 from secure-web-apps/feature/improvements

Several improvements

Author: damienbod

.gitignore

@@ -403,3 +403,6 @@ FodyWeavers.xsd
 # .tfstate files
 *.tfstate
 *.tfstate.*
+
+# wwwroot (as it gets recreated on every npm run build)
+**/wwwroot/*

README.md

@@ -73,6 +73,8 @@ For local development environment setup proceed as follows:
 - What's missing for a production setup?
   - Authorization
   - Data requirements
+  - Update of `ui\public\.well-known\security.txt`
+  - Make use of Azure Key Vault for secrets management
 
 ## Angular CLI Updates
 
@@ -86,15 +88,15 @@ ng update @angular/cli @angular/core
 
 ## History
 
-- 2024-10-06 Angular 18.2.7, updated security headers
-- 2024-10-17 Updated security headers performance, updated packages
-- 2025-01-01 .NET 9, Angular 19
-- 2025-08-30 Angular 20, updated packages
-- 2025-10-27 Updated NuGet packages
-- 2025-10-28 Updated frontend packages, added integration tests, added GitHub Actions workflows
-- 2025-10-30 Fixed deployment to Azure App Service, reverted Angular due to CSP nonce issues
 - 2025-10-31 Updated to Angular CLI and Angular 20.3.0, using vite in dev
-- 2025-10-31 Updated packages, added terraform, sonar SCA, SAST, improved GitHub Actions workflows
+- 2025-10-30 Fixed deployment to Azure App Service, reverted Angular due to CSP nonce issues
+- 2025-10-29 Added terraform, sonar SCA, SAST, improved GitHub Actions workflows
+- 2025-10-28 Updated frontend packages, added integration tests, added GitHub Actions workflows
+- 2025-10-27 Updated NuGet packages
+- 2025-08-30 Angular 20, updated packages
+- 2025-01-01 .NET 9, Angular 19
+- 2024-10-17 Updated security headers performance, updated packages
+- 2024-10-06 Angular 18.2.7, updated security headers
 
 ## Links
 

server/BffMicrosoftEntraID.Server.csproj

@@ -23,6 +23,7 @@
 	<ItemGroup>
 		<PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="9.0.10" NoWarn="NU1605" />
 		<PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="9.0.10" />
+		<PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="9.0.10" />
 		<PackageReference Include="Microsoft.Identity.Web.GraphServiceClient" Version="4.0.1" />
 		<PackageReference Include="Microsoft.Identity.Web" Version="4.0.1" />
 		<PackageReference Include="Microsoft.Identity.Web.UI" Version="4.0.1" />

server/Program.cs

@@ -11,6 +11,8 @@
     serverOptions.AddServerHeader = false;
 });
 
+builder.Services.AddOpenApi();
+
 var services = builder.Services;
 var configuration = builder.Configuration;
 
@@ -77,6 +79,7 @@
 
     app.UseDeveloperExceptionPage();
     app.UseWebAssemblyDebugging();
+    app.MapOpenApi();
 }
 else
 {

server/appsettings.Development.json

@@ -68,6 +68,12 @@
         "Match": {
           "Path": "/{nomatterwhat}.js.map"
         }
+      },
+      "wellknown": {
+        "ClusterId": "cluster1",
+        "Match": {
+          "Path": ".well-known/{**catch-all}"
+        }
       }
     },
     "Clusters": {