Merge pull request #291825 from craigshoemaker/signalr/ropc/disclaimer

[SignalR] Add connection string discliamer

Author: v-dirichards

articles/azure-signalr/concept-connection-string.md

@@ -12,6 +12,8 @@ ms.author: kenchen
 
 A connection string contains information about how to connect to Azure SignalR Service. In this article, you learn the basics of connection strings and how to configure one in your application.
 
+[!INCLUDE [Connection string security](includes/signalr-connection-string-security.md)]
+
 ## What a connection string is
 
 When an application needs to connect to Azure SignalR Service, it needs the following information:
@@ -192,6 +194,8 @@ Endpoint=https://<resource_name>.service.signalr.net;AccessKey=<access_key>;Serv
 
 ## Configure a connection string in your application
 
+[!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
+
 There are two ways to configure a connection string in your application.
 
 You can set the connection string when calling the `AddAzureSignalR()` API:

articles/azure-signalr/includes/signalr-connection-string-security-comment.md

@@ -0,0 +1,12 @@
+---
+title: include file
+description: include file
+author: vicancy
+ms.service: azure-signalr-service
+ms.topic: include
+ms.date: 12/11/2024
+ms.author: lianwei
+ms.custom: include file
+---
+
+Raw connection strings appear in this article for demonstration purposes only. In production environments, always protect your access keys. Use Azure Key Vault to manage and rotate your keys securely and [secure your connection string using Microsoft Entra ID](../concept-connection-string.md#use-microsoft-entra-id).

articles/azure-signalr/includes/signalr-connection-string-security.md

@@ -0,0 +1,17 @@
+---
+title: include file
+description: include file
+author: vicancy
+ms.service: azure-signalr-service
+ms.topic: include
+ms.date: 12/11/2024
+ms.author: lianwei
+ms.custom: include file
+---
+
+> [!IMPORTANT]
+> Raw connection strings appear in this article for demonstration purposes only.
+>
+> A connection string includes the authorization information required for your application to access Azure Web PubSub service. The access key inside the connection string is similar to a root password for your service. In production environments, always protect your access keys. Use Azure Key Vault to manage and rotate your keys securely and [secure your connection string using Microsoft Entra ID](../concept-connection-string.md#use-microsoft-entra-id).
+>
+> Avoid distributing access keys to other users, hard-coding them, or saving them anywhere in plain text that is accessible to others. Rotate your keys if you believe they may have been compromised.

articles/azure-signalr/media/signalr-howto-emulator/emulator-command-running.png

@@ -18,12 +18,16 @@ This sample script creates a new Azure SignalR Service resource, which is used t
 
 [!INCLUDE [azure-cli-prepare-your-environment.md](~/reusable-content/azure-cli/azure-cli-prepare-your-environment.md)]
 
+[!INCLUDE [Connection string security](../includes/signalr-connection-string-security.md)]
+
 ## Sample script
 
 [!INCLUDE [cli-launch-cloud-shell-sign-in.md](~/reusable-content/ce-skilling/azure/includes/cli-launch-cloud-shell-sign-in.md)]
 
 ### Run the script
 
+[!INCLUDE [Connection string security comment](../includes/signalr-connection-string-security-comment.md)]
+
 :::code language="azurecli" source="~/azure_cli_scripts/azure-signalr/create-signalr-with-app-service/create-signalr-with-app-service.sh" id="FullScript":::
 
 ## Clean up resources

articles/azure-signalr/scripts/signalr-cli-create-with-app-service.md

@@ -12,6 +12,8 @@ ms.date: 04/02/2024
 
 The first request between a client and a server is the negotiation request. When you use self-hosted SignalR, you use the request to establish a connection between the client and the server. And when you use Azure SignalR Service, clients connect to the service instead of the application server. This article shares concepts about negotiation protocols and ways to customize a negotiation endpoint.
 
+[!INCLUDE [Connection string security](includes/signalr-connection-string-security.md)]
+
 ## What is negotiation?
 
 The response to the `POST [endpoint-base]/negotiate` request contains one of three types of responses:
@@ -155,7 +157,9 @@ private class CustomRouter : EndpointRouterDecorator
 }
 ```
 
-Also register the router to dependency injection:
+Also register the router to dependency injection.
+
+[!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
 
 ```cs
 // Sample of configuring multiple endpoints and dependency injection

articles/azure-signalr/signalr-concept-client-negotiation.md

@@ -17,6 +17,8 @@ Azure Functions applications can use the [Azure SignalR Service bindings](../azu
 
 This article describes the concepts for developing and configuring an Azure Function app that is integrated with SignalR Service.
 
+[!INCLUDE [Connection string security](includes/signalr-connection-string-security.md)]
+
 ## SignalR Service configuration
 
 Azure SignalR Service can be configured in [different modes](concept-service-mode.md). When used with Azure Functions, the service must be configured in **Serverless** mode.
@@ -153,7 +155,10 @@ public interface IChatClient
 }
 ```
 
-Then you can use the strongly typed methods as follows:
+Then you can use the strongly typed methods as follows.
+
+[!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
+
 ```cs
 [SignalRConnection("AzureSignalRConnectionString")]
 public class Functions : ServerlessHub<IChatClient>

articles/azure-signalr/signalr-concept-serverless-development-config.md

@@ -19,6 +19,8 @@ You can enable other types of data collection after some configuration. This art
 - For more information about monitoring Azure SignalR Service, see [Monitor Azure SignalR Service](monitor-signalr.md).
 - For a detailed listing of the metrics and logs collected for Azure SignalR Service, see [Azure SignalR Service monitoring data reference](monitor-signalr-reference.md).
 
+[!INCLUDE [Connection string security](includes/signalr-connection-string-security.md)]
+
 ## Prerequisites
 
 To enable resource logs, you need to set up a place to store your log data, such as Azure Storage or Log Analytics.
@@ -241,7 +243,9 @@ To enable this behavior, uncheck the checkbox for a specific log type in the **T
 
 ##### Server side
 
-Also set up `ServiceOptions.DiagnosticClientFilter` to define a filter of diagnostic clients based on the http context comes from clients. For example, make client with hub URL `<HUB_URL>?diag=yes`, then set up `ServiceOptions.DiagnosticClientFilter` to filter the diagnostic client. If it returns `true`, the client is marked as diagnostic client. Otherwise, it stays as normal client. The `ServiceOptions.DiagnosticClientFilter` can be set in your startup class like this:
+Also set up `ServiceOptions.DiagnosticClientFilter` to define a filter of diagnostic clients based on the http context comes from clients. For example, make client with hub URL `<HUB_URL>?diag=yes`, then set up `ServiceOptions.DiagnosticClientFilter` to filter the diagnostic client. If it returns `true`, the client is marked as diagnostic client. Otherwise, it stays as normal client. The following example show how to use the `ServiceOptions.DiagnosticClientFilter` in your startup class.
+
+[!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
 
 ``` C#
 // sample: mark a client as diagnostic client when it has query string "?diag=yes" in hub URL

articles/azure-signalr/signalr-howto-diagnostic-logs.md

@@ -17,10 +17,14 @@ When developing serverless applications, we provide an Azure SignalR Local Emula
 * Latest Rest API support
 * Upstream
 
+[!INCLUDE [Connection string security](includes/signalr-connection-string-security.md)]
+
 ## Walkthrough
 
 We use [this serverless sample](https://github.com/Azure/azure-functions-signalrservice-extension/tree/3e87c3ce277265866ca9d0bf51bb9c7ecea39e14/samples/bidirectional-chat) to show how to use the emulator.
 
+[!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
+
 1. Clone the sample repo to local
     ```
     git clone https://github.com/Azure/azure-functions-signalrservice-extension.git
@@ -69,9 +73,7 @@ We use [this serverless sample](https://github.com/Azure/azure-functions-signalr
     asrs-emulator start
     ```
 
-    After the emulator is successfully started, it generates the ConnectionString to be used later, for example, the ConnectionString is `Endpoint=http://localhost;Port=8888;AccessKey=ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789ABCDEFGH;Version=1.0;` as the below screenshot shows.
-    
-    :::image type="content" source="./media/signalr-howto-emulator/emulator-command-running.png" alt-text="Screenshot of the emulator command is running.":::
+    After the emulator is successfully started, it generates the ConnectionString to be used later.
 
     The emulator also provides advanced options when start, for example, you can use `asrs-emulator start -p 8999` to customize the port the emulator used. Type `asrs-emulator start --help` to check the options available.
 

articles/azure-signalr/signalr-howto-emulator.md

@@ -19,6 +19,8 @@ Azure Event Grid is a fully managed event routing service that provides uniform
 [!INCLUDE [azure-cli-prepare-your-environment.md](~/reusable-content/azure-cli/azure-cli-prepare-your-environment.md)]
 
  - The Azure CLI commands in this article are formatted for the **Bash** shell. If you're using a different shell like PowerShell or Command Prompt, you may need to adjust line continuation characters or variable assignment lines accordingly. This article uses variables to minimize the amount of command editing required.
+ 
+[!INCLUDE [Connection string security](includes/signalr-connection-string-security.md)]
 
 ## Create a resource group
 
@@ -139,6 +141,8 @@ When the subscription is completed, you should see output similar to the followi
 
 Switch to the service mode to `Serverless Mode` and set up a client connection to the SignalR Service. You can take [Serverless Sample](https://github.com/aspnet/AzureSignalR-samples/tree/master/samples/Serverless) as a reference.
 
+[!INCLUDE [Connection string security comment](includes/signalr-connection-string-security-comment.md)]
+
 ```bash
 git clone [email protected]:aspnet/AzureSignalR-samples.git