A secure ASP.NET Core Web API reference application using Managed Identity, Key Vault, and Cosmos DB that is designed to be deployed to Azure App Service or AKS.
For secrets that are retrieved from KeyVault and kept in memory we should use SecureString so if the memory were ever able to be dumped the secrets would not be exposed.
name: Found Dead Links
about: Dead link
title: 'Dead link(s) found in markdown files in helium-csharp repository'
labels: 'Documentation'
assignees: ''
To find the dead links, please review the GitHub Actions logs for this repository
During the ADS session with customer, Helium was identified as an enabler and accelerator for the project by re-using some of its key components and patterns.
We have started contributing back to Helium based on engagement requirements. The major contributions are towards working with Cosmos DB.
Team already submitted PR's and will also contribute further.
The solution could create Cosmos Client object during initialization phase and store it in IoC container. The controllers and business objects could later retrieve the same whenever needed by code. The lifetime for such objects could be singleton or scoped.
I believe that CosmosDBService is currently susceptible to SQL injection attacks because SQL strings are being built with simple string concatenation.
Reproduce
If we were to call one of CosmosDBService's methods such as queryActors using a malicious query string parameter such as an actor name of "Joe Smith; DELETE * FROM actors;" then we have an attack vector.
Additional Context
(If applicable: Add any other context about the problem here; for example: doc changes, screenshots, logs, links, etc)
At moderate load, about 2% of the 400 / 404 responses are significantly slower than mean and average. Since there are no external dependencies, the response rate should be very consistent. Need to investigate and also check for other "flyers" on different request types.
After more research, most of the variance is in the 404 errors.
name: Found Dead Links
about: Dead link
title: 'Dead link(s) found in markdown files in helium-csharp repository'
labels: 'Documentation'
assignees: ''
To find the dead links, please review the GitHub Actions logs for this repository
Improve developer experience by writing log messages which are relevant to the method calling them. For example, logger.InvalidGenreParameter(context).
Performance test and document differences from default main branch.
Based on performance results, decide whether or not to implement new feature.
Alternative Proposals
Keep the existing logger implementation.
Additional Context
Since performance is a key objective for Helium, any small improvements we can observe, document, and implement will result in a better customer experience at scale.
This is especially useful when the number of documents are large in Cosmos DB collection. Looping them on demand using continuation token and using stream iterators would improve performance, the memory footprint would be small, cost effective from RU perspective and providing paging benefits to callee.
When running this docker file in a network restricted environment, it is necessary to sometime set the value of the following variables so that the dotnet command can pull packages from nuget
name: Found Dead Links
about: Dead link
title: 'Dead link(s) found in markdown files in helium-csharp repository'
labels: 'Documentation'
assignees: ''
To find the dead links, please review the GitHub Actions logs for this repository
As a web application developer, I want a reference web application that is secure by default while leveraging engineering best practices so that I can easily fork and code and deploy.
Acceptance Criteria
Provide a step-by-step quick start that delivers a positive developer experience
Securely build, deploy, and run an Azure App Service (Web App for Containers) application
Securely build, deploy and run an Azure Kubernetes Service (AKS) application
Use Managed Identity to securely access resources
Securely store, access, and maintain secrets in Key Vault
Securely build and deploy the Docker container from Azure Container Registry (ACR), Azure DevOps, GitHub Actions or manually
Securely connect to and query Cosmos DB
Automatically send telemetry and logs to Azure Monitor
Key Features
Security
"Secure by Design"
Managed Identity
Pod Identity
Key Vault
Key Rotation
Developer Experience
Cloud Native Platform (containerization)
ACR
App Services
AKS
DevOps
IaC
CI-CD
End-to-end Testing
CosmosDB
Document Modeling
RU optimization
Key Rotation
Observability
Logging
Monitoring
Alerting
Developer Experience
Secure by Design
Fork and Code
Local dev or container dev
Definition of Done
Code changes reviewed & signed off
Existing documentation is updated (readme, .md's)
New documentation needed to support the change is created
Code changes checked into master
All existing automated tests (unit and/or e2e) pass successfully, new tests added as needed
Build completes successfully
Deployment completes successfully
Smoke test production deployment for minimum of 2 weeks
name: Found Dead Links
about: Dead link
title: 'Dead link(s) found in markdown files in helium-csharp repository'
labels: 'Documentation'
assignees: ''
To find the dead links, please review the GitHub Actions logs for this repository
name: Found Dead Links
about: Dead link
title: 'Dead link(s) found in markdown files in helium-csharp repository'
labels: 'Documentation'
assignees: ''
To find the dead links, please review the GitHub Actions logs for this repository
Remove "deathYear" from API output when the field does not exist in the database's Actor document (when the actor is still alive), currently, it defaults to 0 when the field does not exist.
Check for any other regressions that may have been introduced after upgrade to dotnet 3.0