SourceMapSecurity.AspDotNetCore 1.0.0

• .NETCoreApp 3.1

  • Microsoft.AspNetCore.Http (>= 2.2.2)

How to use
All you need to do is add this middleware to your Configure method in the Startup class.

NOTE: The placement of this middleware in your pipeline is important. You need to make sure this it's added before app.UseStaticFiles();, otherwise it will not restrict access to your source map files.

Most basic configuration (no options specified).
// Default options, all clients are forbidden from downloading source maps and by
// default receive a 403 status code.
app.UseSourceMapSecurity();
More advanced configuration
app.UseSourceMapSecurity(new SourceMapSecurityOptions()
{
   // You can modify the HTTP status code returned to the client when they don't have access,
// in case you would rather not show that a resource is there at all.
   DisallowedHttpStatusCode = 404,

   // You can modify this method to determine whether or not source maps should be returned
// to the client, based on their HttpContext.
   // Returning true means source maps are allowed.
   // Returning false means source maps are disallowed.
   // In this example implementation below, source maps are only allowed if you're logged in,
// or in the development environment.
   IsAllowedAsync = async (context) =>
   {
       if (!env.IsDevelopment() && !context.User.Identity.IsAuthenticated)
       {
           return false;
       }
       return true;
   }
});