Merge pull request #291825 from craigshoemaker/signalr/ropc/disclaimer

v-dirichards · web-flow · commit 92ac95a67180 · 2024-12-11T16:18:31.000-06:00
[SignalR] Add connection string discliamer
diff --git a/articles/azure-signalr/concept-connection-string.md b/articles/azure-signalr/concept-connection-string.md
@@ -12,6 +12,8 @@ ms.author: kenchen
 
 A connection string contains information about how to connect to Azure SignalR Service. In this article, you learn the basics of connection strings and how to configure one in your application.
 
+[!INCLUDE [Connection string security](includes/signalr-connection-string-security.md)]
+
 ## What a connection string is
 
 When an application needs to connect to Azure SignalR Service, it needs the following information:
@@ -192,6 +194,8 @@ Endpoint=https://<resource_name>.service.signalr.net;AccessKey=<access_key>;Serv
 
 ## Configure a connection string in your application
 
+[!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
+
 There are two ways to configure a connection string in your application.
 
 You can set the connection string when calling the `AddAzureSignalR()` API:
diff --git a/articles/azure-signalr/includes/signalr-connection-string-security-comment.md b/articles/azure-signalr/includes/signalr-connection-string-security-comment.md
@@ -0,0 +1,12 @@
+---
+title: include file
+description: include file
+author: vicancy
+ms.service: azure-signalr-service
+ms.topic: include
+ms.date: 12/11/2024
+ms.author: lianwei
+ms.custom: include file
+---
+
+Raw connection strings appear in this article for demonstration purposes only. In production environments, always protect your access keys. Use Azure Key Vault to manage and rotate your keys securely and [secure your connection string using Microsoft Entra ID](../concept-connection-string.md#use-microsoft-entra-id).
diff --git a/articles/azure-signalr/includes/signalr-connection-string-security.md b/articles/azure-signalr/includes/signalr-connection-string-security.md
@@ -0,0 +1,17 @@
+---
+title: include file
+description: include file
+author: vicancy
+ms.service: azure-signalr-service
+ms.topic: include
+ms.date: 12/11/2024
+ms.author: lianwei
+ms.custom: include file
+---
+
+> [!IMPORTANT]
+> Raw connection strings appear in this article for demonstration purposes only.
+>
+> A connection string includes the authorization information required for your application to access Azure Web PubSub service. The access key inside the connection string is similar to a root password for your service. In production environments, always protect your access keys. Use Azure Key Vault to manage and rotate your keys securely and [secure your connection string using Microsoft Entra ID](../concept-connection-string.md#use-microsoft-entra-id).
+>
+> Avoid distributing access keys to other users, hard-coding them, or saving them anywhere in plain text that is accessible to others. Rotate your keys if you believe they may have been compromised.
diff --git a/articles/azure-signalr/media/signalr-howto-emulator/emulator-command-running.png b/articles/azure-signalr/media/signalr-howto-emulator/emulator-command-running.png
diff --git a/articles/azure-signalr/scripts/signalr-cli-create-with-app-service.md b/articles/azure-signalr/scripts/signalr-cli-create-with-app-service.md
@@ -18,12 +18,16 @@ This sample script creates a new Azure SignalR Service resource, which is used t
 
 [!INCLUDE [azure-cli-prepare-your-environment.md](~/reusable-content/azure-cli/azure-cli-prepare-your-environment.md)]
 
+[!INCLUDE [Connection string security](../includes/signalr-connection-string-security.md)]
+
 ## Sample script
 
 [!INCLUDE [cli-launch-cloud-shell-sign-in.md](~/reusable-content/ce-skilling/azure/includes/cli-launch-cloud-shell-sign-in.md)]
 
 ### Run the script
 
+[!INCLUDE [Connection string security comment](../includes/signalr-connection-string-security-comment.md)]
+
 :::code language="azurecli" source="~/azure_cli_scripts/azure-signalr/create-signalr-with-app-service/create-signalr-with-app-service.sh" id="FullScript":::
 
 ## Clean up resources
diff --git a/articles/azure-signalr/signalr-concept-client-negotiation.md b/articles/azure-signalr/signalr-concept-client-negotiation.md
@@ -12,6 +12,8 @@ ms.date: 04/02/2024
 
 The first request between a client and a server is the negotiation request. When you use self-hosted SignalR, you use the request to establish a connection between the client and the server. And when you use Azure SignalR Service, clients connect to the service instead of the application server. This article shares concepts about negotiation protocols and ways to customize a negotiation endpoint.
 
+[!INCLUDE [Connection string security](includes/signalr-connection-string-security.md)]
+
 ## What is negotiation?
 
 The response to the `POST [endpoint-base]/negotiate` request contains one of three types of responses:
@@ -155,7 +157,9 @@ private class CustomRouter : EndpointRouterDecorator
 }
 ```
 
-Also register the router to dependency injection:
+Also register the router to dependency injection.
+
+[!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
 
 ```cs
 // Sample of configuring multiple endpoints and dependency injection
diff --git a/articles/azure-signalr/signalr-concept-serverless-development-config.md b/articles/azure-signalr/signalr-concept-serverless-development-config.md
@@ -17,6 +17,8 @@ Azure Functions applications can use the [Azure SignalR Service bindings](../azu
 
 This article describes the concepts for developing and configuring an Azure Function app that is integrated with SignalR Service.
 
+[!INCLUDE [Connection string security](includes/signalr-connection-string-security.md)]
+
 ## SignalR Service configuration
 
 Azure SignalR Service can be configured in [different modes](concept-service-mode.md). When used with Azure Functions, the service must be configured in **Serverless** mode.
@@ -153,7 +155,10 @@ public interface IChatClient
 }
 ```
 
-Then you can use the strongly typed methods as follows:
+Then you can use the strongly typed methods as follows.
+
+[!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
+
 ```cs
 [SignalRConnection("AzureSignalRConnectionString")]
 public class Functions : ServerlessHub<IChatClient>
diff --git a/articles/azure-signalr/signalr-howto-diagnostic-logs.md b/articles/azure-signalr/signalr-howto-diagnostic-logs.md
@@ -19,6 +19,8 @@ You can enable other types of data collection after some configuration. This art
 - For more information about monitoring Azure SignalR Service, see [Monitor Azure SignalR Service](monitor-signalr.md).
 - For a detailed listing of the metrics and logs collected for Azure SignalR Service, see [Azure SignalR Service monitoring data reference](monitor-signalr-reference.md).
 
+[!INCLUDE [Connection string security](includes/signalr-connection-string-security.md)]
+
 ## Prerequisites
 
 To enable resource logs, you need to set up a place to store your log data, such as Azure Storage or Log Analytics.
@@ -241,7 +243,9 @@ To enable this behavior, uncheck the checkbox for a specific log type in the **T
 
 ##### Server side
 
-Also set up `ServiceOptions.DiagnosticClientFilter` to define a filter of diagnostic clients based on the http context comes from clients. For example, make client with hub URL `<HUB_URL>?diag=yes`, then set up `ServiceOptions.DiagnosticClientFilter` to filter the diagnostic client. If it returns `true`, the client is marked as diagnostic client. Otherwise, it stays as normal client. The `ServiceOptions.DiagnosticClientFilter` can be set in your startup class like this:
+Also set up `ServiceOptions.DiagnosticClientFilter` to define a filter of diagnostic clients based on the http context comes from clients. For example, make client with hub URL `<HUB_URL>?diag=yes`, then set up `ServiceOptions.DiagnosticClientFilter` to filter the diagnostic client. If it returns `true`, the client is marked as diagnostic client. Otherwise, it stays as normal client. The following example show how to use the `ServiceOptions.DiagnosticClientFilter` in your startup class.
+
+[!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
 
 ``` C#
 // sample: mark a client as diagnostic client when it has query string "?diag=yes" in hub URL
diff --git a/articles/azure-signalr/signalr-howto-emulator.md b/articles/azure-signalr/signalr-howto-emulator.md
@@ -17,10 +17,14 @@ When developing serverless applications, we provide an Azure SignalR Local Emula
 * Latest Rest API support
 * Upstream
 
+[!INCLUDE [Connection string security](includes/signalr-connection-string-security.md)]
+
 ## Walkthrough
 
 We use [this serverless sample](https://github.com/Azure/azure-functions-signalrservice-extension/tree/3e87c3ce277265866ca9d0bf51bb9c7ecea39e14/samples/bidirectional-chat) to show how to use the emulator.
 
+[!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
+
 1. Clone the sample repo to local
     ```
     git clone https://github.com/Azure/azure-functions-signalrservice-extension.git
@@ -69,9 +73,7 @@ We use [this serverless sample](https://github.com/Azure/azure-functions-signalr
     asrs-emulator start
     ```
 
-    After the emulator is successfully started, it generates the ConnectionString to be used later, for example, the ConnectionString is `Endpoint=http://localhost;Port=8888;AccessKey=ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789ABCDEFGH;Version=1.0;` as the below screenshot shows.
-    
-    :::image type="content" source="./media/signalr-howto-emulator/emulator-command-running.png" alt-text="Screenshot of the emulator command is running.":::
+    After the emulator is successfully started, it generates the ConnectionString to be used later.
 
     The emulator also provides advanced options when start, for example, you can use `asrs-emulator start -p 8999` to customize the port the emulator used. Type `asrs-emulator start --help` to check the options available.
 
diff --git a/articles/azure-signalr/signalr-howto-event-grid-integration.md b/articles/azure-signalr/signalr-howto-event-grid-integration.md
@@ -19,6 +19,8 @@ Azure Event Grid is a fully managed event routing service that provides uniform
 [!INCLUDE [azure-cli-prepare-your-environment.md](~/reusable-content/azure-cli/azure-cli-prepare-your-environment.md)]
 
  - The Azure CLI commands in this article are formatted for the **Bash** shell. If you're using a different shell like PowerShell or Command Prompt, you may need to adjust line continuation characters or variable assignment lines accordingly. This article uses variables to minimize the amount of command editing required.
+ 
+[!INCLUDE [Connection string security](includes/signalr-connection-string-security.md)]
 
 ## Create a resource group
 
@@ -139,6 +141,8 @@ When the subscription is completed, you should see output similar to the followi
 
 Switch to the service mode to `Serverless Mode` and set up a client connection to the SignalR Service. You can take [Serverless Sample](https://github.com/aspnet/AzureSignalR-samples/tree/master/samples/Serverless) as a reference.
 
+[!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
+
 ```bash
 git clone git@github.com:aspnet/AzureSignalR-samples.git
 
diff --git a/articles/azure-signalr/signalr-howto-reverse-proxy-overview.md b/articles/azure-signalr/signalr-howto-reverse-proxy-overview.md
@@ -14,11 +14,15 @@ A reverse proxy server can be used in front of Azure SignalR Service. Reverse pr
 
 A common architecture using a reverse proxy server with Azure SignalR is as below:
 
-:::image type="content" source="./media/signalr-howto-reverse-proxy-overview/architecture.png" alt-text="Diagram that shows the architecture using Azure SignalR with a reverse proxy server.":::   
+:::image type="content" source="./media/signalr-howto-reverse-proxy-overview/architecture.png" alt-text="Diagram that shows the architecture using Azure SignalR with a reverse proxy server.":::
+
+[!INCLUDE [Connection string security](includes/signalr-connection-string-security.md)]
 
 ## General practices
 There are several general practices to follow when using a reverse proxy in front of SignalR Service.
 
+[!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
+
 * Make sure to rewrite the incoming HTTP [HOST header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Host) with the Azure SignalR service URL, e.g. `https://demo.service.signalr.net`. Azure SignalR is a multi-tenant service, and it relies on the `HOST` header to resolve to the correct endpoint. For example, when [configuring Application Gateway](./signalr-howto-work-with-app-gateway.md#create-an-application-gateway-instance) for Azure SignalR, select **Yes** for the option *Override with new host name*.
 
 * When your client goes through your reverse proxy to Azure SignalR, set `ClientEndpoint` as your reverse proxy URL. When your client *negotiate*s with your hub server, the hub server will return the URL defined in `ClientEndpoint` for your client to connect. [Check here for more details.](./concept-connection-string.md#provide-client-and-server-endpoints)
diff --git a/articles/azure-signalr/signalr-howto-scale-multi-instances.md b/articles/azure-signalr/signalr-howto-scale-multi-instances.md
@@ -16,11 +16,15 @@ zone_pivot_groups: azure-signalr-service-mode
 
 SignalR Service SDK supports multiple endpoints for SignalR Service instances. You can use this feature to scale the concurrent connections, or use it for cross-region messaging.
 
+[!INCLUDE [Connection string security](includes/signalr-connection-string-security.md)]
+
 :::zone pivot="default-mode"
 ## For ASP.NET Core
 
 ### Add multiple endpoints from config
 
+[!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
+
 Configure with key `Azure:SignalR:ConnectionString` or `Azure:SignalR:ConnectionString:` for SignalR Service connection string.
 
 If the key starts with `Azure:SignalR:ConnectionString:`, it should be in the format `Azure:SignalR:ConnectionString:{Name}:{EndpointType}`, where `Name` and `EndpointType` are properties of the `ServiceEndpoint` object, and are accessible from code.
diff --git a/articles/azure-signalr/signalr-howto-use-management-sdk.md b/articles/azure-signalr/signalr-howto-use-management-sdk.md
@@ -16,6 +16,8 @@ Azure SignalR Management SDK helps you to manage SignalR clients through Azure S
 > 
 > To see guides for SDK version 1.9.x and before, go to [Azure SignalR Service Management SDK (Legacy)](https://github.com/Azure/azure-signalr/blob/dev/docs/management-sdk-guide-legacy.md). You might also want to read [Migration guidance](https://github.com/Azure/azure-signalr/blob/dev/docs/management-sdk-migration.md).
 
+[!INCLUDE [Connection string security](includes/signalr-connection-string-security.md)]
+
 ## Features
 
 | Feature                                    | Transient          | Persistent         |
@@ -56,7 +58,9 @@ This section shows how to use the Management SDK.
 
 ### Create Service Manager
 
-Build your instance of `ServiceManager` from a `ServiceManagerBuilder`
+Build your instance of `ServiceManager` from a `ServiceManagerBuilder`.
+
+[!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
 
 ``` C#
 
diff --git a/articles/azure-signalr/signalr-howto-use.md b/articles/azure-signalr/signalr-howto-use.md
@@ -10,9 +10,10 @@ ms.author: lianwei
 
 # Use Azure SignalR Service
 
-
 This article shows you how to use SDK in your app server side to connect to SignalR Service when you are using SignalR in your app server.
 
+[!INCLUDE [Connection string security](includes/signalr-connection-string-security.md)]
+
 ## Create an Azure SignalR Service instance
 
 Follow [Quickstart: Use an ARM template to deploy Azure SignalR](./signalr-quickstart-azure-signalr-service-arm-template.md) to create a SignalR service instance.
@@ -47,6 +48,8 @@ public void Configure(IApplicationBuilder app)
 
 ### Configure connection string
 
+[!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
+
 There are two approaches to configure SignalR Service's connection string in your application.
 
 - Set an environment variable with name `Azure:SignalR:ConnectionString` or `Azure__SignalR__ConnectionString`.
diff --git a/articles/azure-signalr/signalr-howto-work-with-apim.md b/articles/azure-signalr/signalr-howto-work-with-apim.md
@@ -14,6 +14,8 @@ Azure API Management service provides a hybrid, multicloud management platform f
 
 :::image type="content" source="./media/signalr-howto-work-with-apim/architecture.png" alt-text="Diagram that shows the architecture of using SignalR Service with API Management.":::
 
+[!INCLUDE [Connection string security](includes/signalr-connection-string-security.md)]
+
 ## Create resources
 
 - Follow [Quickstart: Use an ARM template to deploy Azure SignalR](./signalr-quickstart-azure-signalr-service-arm-template.md) and create a SignalR Service instance **_ASRS1_**
@@ -110,6 +112,8 @@ Now API Management is successfully configured to support SignalR client with `Se
 
 Now, the traffic can reach SignalR Service through API Management. Let’s use [this chat application](https://github.com/aspnet/AzureSignalR-samples/tree/main/samples/ChatRoom) as an example. Let's start with running it locally.
 
+[!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
+
 - First let's get the connection string of **_ASRS1_**
 
   - On the **Connection strings** tab of **_ASRS1_**
diff --git a/articles/azure-signalr/signalr-howto-work-with-app-gateway.md b/articles/azure-signalr/signalr-howto-work-with-app-gateway.md
@@ -24,6 +24,8 @@ This article contains two parts,
 
 :::image type="content" source="./media/signalr-howto-work-with-app-gateway/architecture.png" alt-text="Diagram that shows the architecture of using SignalR Service with Application Gateway.":::
 
+[!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
+
 ## Set up and configure Application Gateway
 
 ### Create a SignalR Service instance
@@ -139,6 +141,8 @@ When **_AG1_** is created, go to **Health probes** tab under **Settings** sectio
 
 Now, the traffic can reach SignalR Service through the Application Gateway. The customer could use the Application Gateway public IP address or custom domain name to access the resource. Let’s use [this chat application](https://github.com/aspnet/AzureSignalR-samples/tree/main/samples/ChatRoom) as an example. Let's start with running it locally.
 
+[!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
+
 - First let's get the connection string of **_ASRS1_**
 
   - On the **Connection strings** tab of **_ASRS1_**
diff --git a/articles/azure-signalr/signalr-quickstart-azure-functions-csharp.md b/articles/azure-signalr/signalr-quickstart-azure-functions-csharp.md
@@ -26,6 +26,8 @@ In this article, you learn how to use SignalR Service and Azure Functions to bui
 
 ---
 
+[!INCLUDE [Connection string security](includes/signalr-connection-string-security.md)]
+
 ## Prerequisites
 
 The following prerequisites are needed for this quickstart:
@@ -275,7 +277,9 @@ You need the Azure Functions Core Tools for this step.
 
         ![Screenshot that highlights the primary connection string.](media/signalr-quickstart-azure-functions-javascript/signalr-quickstart-keys.png)
 
-    1. Copy the primary connection string, and then run the following command:
+    1. Copy the primary connection string, and then run the following command.
+    
+        [!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
 
         ```bash
         func settings add AzureSignalRConnectionString "<signalr-connection-string>"
diff --git a/articles/azure-signalr/signalr-quickstart-azure-functions-java.md b/articles/azure-signalr/signalr-quickstart-azure-functions-java.md
@@ -17,6 +17,8 @@ In this article, you'll use Azure SignalR Service, Azure Functions, and Java to
 > [!NOTE]
 > The code in this article is available on [GitHub](https://github.com/aspnet/AzureSignalR-samples/tree/main/samples/QuickStartServerless/java).
 
+[!INCLUDE [Connection string security](includes/signalr-connection-string-security.md)]
+
 ## Prerequisites
 
 - A code editor, such as [Visual Studio Code](https://code.visualstudio.com/)
@@ -219,7 +221,9 @@ Make sure you have Azure Function Core Tools, Java (version 11 in the sample), a
 
         ![Screenshot that highlights the primary connection string.](media/signalr-quickstart-azure-functions-javascript/signalr-quickstart-keys.png)
 
-    1. Copy the primary connection string, and then run the following command:
+    1. Copy the primary connection string, and then run the following command.
+
+        [!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
 
         ```bash
         func settings add AzureSignalRConnectionString "<signalr-connection-string>"
diff --git a/articles/azure-signalr/signalr-quickstart-azure-functions-javascript.md b/articles/azure-signalr/signalr-quickstart-azure-functions-javascript.md
@@ -13,6 +13,8 @@ ms.custom: devx-track-js, mode-api
 
  In this article, you use Azure SignalR Service, Azure Functions, and JavaScript to build a serverless application to broadcast messages to clients.
 
+[!INCLUDE [Connection string security](includes/signalr-connection-string-security.md)]
+
 ## Prerequisites
 
 This quickstart can be run on macOS, Windows, or Linux.
@@ -135,7 +137,9 @@ You're almost done now. The last step is to set the SignalR Service connection s
 
     :::image type="content" source="media/signalr-quickstart-azure-functions-javascript/signalr-quickstart-keys.png" alt-text="Screenshot of Azure SignalR service Keys page.":::
 
-1. Copy the primary connection string, and execute the command:
+1. Copy the primary connection string, and execute the command.
+
+    [!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
 
     ```bash
     func settings add AzureSignalRConnectionString "<signalr-connection-string>"
diff --git a/articles/azure-signalr/signalr-quickstart-azure-functions-python.md b/articles/azure-signalr/signalr-quickstart-azure-functions-python.md
diff --git a/articles/azure-signalr/signalr-quickstart-dotnet-core.md b/articles/azure-signalr/signalr-quickstart-dotnet-core.md
diff --git a/articles/azure-signalr/signalr-quickstart-dotnet.md b/articles/azure-signalr/signalr-quickstart-dotnet.md
diff --git a/articles/azure-signalr/signalr-quickstart-rest-api.md b/articles/azure-signalr/signalr-quickstart-rest-api.md
diff --git a/articles/azure-signalr/signalr-tutorial-authenticate-azure-functions.md b/articles/azure-signalr/signalr-tutorial-authenticate-azure-functions.md
diff --git a/articles/azure-signalr/signalr-tutorial-build-blazor-server-chat-app.md b/articles/azure-signalr/signalr-tutorial-build-blazor-server-chat-app.md
