Merge pull request #33971 from dotnet/main

Rick-Anderson · web-flow · commit 7e970a8cfec1 · 2024-10-30T12:05:08.000-10:00
Merge to Live
diff --git a/aspnetcore/fundamentals/configuration/index.md b/aspnetcore/fundamentals/configuration/index.md
@@ -8,6 +8,7 @@ ms.custom: mvc
 ms.date: 04/26/2024
 uid: fundamentals/configuration/index
 ---
+<!-- ms.sfi.ropc: t -->
 # Configuration in ASP.NET Core
 
 By [Rick Anderson](https://twitter.com/RickAndMSFT) and [Kirk Larkin](https://twitter.com/serpent5)
@@ -158,15 +159,15 @@ Configuration data guidelines:
 * Never store passwords or other sensitive data in configuration provider code or in plain text configuration files. The [Secret Manager](xref:security/app-secrets) tool can be used to store secrets in development.
 * Don't use production secrets in development or test environments.
 * Specify secrets outside of the project so that they can't be accidentally committed to a source code repository.
+* Production apps should use the most secure authentication flow available. For more information, see [Secure authentication flows](xref:security/index#secure-authentication-flows).
 
 By [default](#default), the user secrets configuration source is registered after the JSON configuration sources. Therefore, user secrets keys take precedence over keys in `appsettings.json` and `appsettings.{Environment}.json`.
 
 For more information on storing passwords or other sensitive data:
 
 * <xref:fundamentals/environments>
 * <xref:security/app-secrets>: Includes advice on using environment variables to store sensitive data. The Secret Manager tool uses the [File configuration provider](#fcp) to store user secrets in a JSON file on the local system.
-
-[Azure Key Vault](https://azure.microsoft.com/services/key-vault/) safely stores app secrets for ASP.NET Core apps. For more information, see <xref:security/key-vault-configuration>.
+* [Azure Key Vault](https://azure.microsoft.com/services/key-vault/) safely stores app secrets for ASP.NET Core apps. For more information, see <xref:security/key-vault-configuration>.
 
 <a name="evcp"></a>
 
@@ -408,6 +409,8 @@ The preferred way to read hierarchical configuration data is using the options p
 
 ## Configuration keys and values
 
+[!INCLUDE [managed-identities](~/includes/managed-identities-conn-strings.md)]
+
 Configuration keys:
 
 * Are case-insensitive. For example, `ConnectionString` and `connectionstring` are treated as equivalent keys.
@@ -459,6 +462,8 @@ The preceding sequence of providers is used in the [default configuration](#defa
 
 ### Connection string prefixes
 
+[!INCLUDE [managed-identities](~/includes/managed-identities-conn-strings.md)]
+
 The Configuration API has special processing rules for four connection string environment variables. These connection strings are involved in configuring Azure connection strings for the app environment. Environment variables with the prefixes shown in the table are loaded into the app with the [default configuration](#default) or when no prefix is supplied to `AddEnvironmentVariables`.
 
 | Connection string prefix | Provider |
diff --git a/aspnetcore/fundamentals/configuration/index/includes/index3-5.md b/aspnetcore/fundamentals/configuration/index/includes/index3-5.md
@@ -1,5 +1,5 @@
 :::moniker range=">= aspnetcore-5.0 < aspnetcore-6.0"
-
+<!-- ms.sfi.ropc: t -->
 <a name="kestrel"></a>
 
 ## Kestrel endpoint configuration
@@ -149,6 +149,8 @@ Custom configuration providers aren't required to implement array binding.
 
 ## Custom configuration provider
 
+[!INCLUDE [managed-identities](~/includes/managed-identities-conn-strings.md)]
+
 The sample app demonstrates how to create a basic configuration provider that reads configuration key-value pairs from a database using [Entity Framework (EF)](/ef/core/).
 
 The provider has the following characteristics:
diff --git a/aspnetcore/fundamentals/configuration/index/includes/index6.md b/aspnetcore/fundamentals/configuration/index/includes/index6.md
@@ -1,5 +1,5 @@
 :::moniker range="= aspnetcore-6.0"
-
+<!-- ms.sfi.ropc: t -->
 Application configuration in ASP.NET Core is performed using one or more [configuration providers](#cp). Configuration providers read configuration data from key-value pairs using a variety of configuration sources:
 
 * Settings files, such as `appsettings.json`
@@ -135,6 +135,7 @@ Configuration data guidelines:
 * Never store passwords or other sensitive data in configuration provider code or in plain text configuration files. The [Secret Manager](xref:security/app-secrets) tool can be used to store secrets in development.
 * Don't use production secrets in development or test environments.
 * Specify secrets outside of the project so that they can't be accidentally committed to a source code repository.
+* Production apps should use the most secure authentication flow available. For more information, see [Secure authentication flows](xref:security/index#secure-authentication-flows).
 
 By [default](#default), the user secrets configuration source is registered after the JSON configuration sources. Therefore, user secrets keys take precedence over keys in `appsettings.json` and `appsettings.{Environment}.json`.
 
@@ -385,6 +386,8 @@ The preferred way to read hierarchical configuration data is using the options p
 
 ## Configuration keys and values
 
+[!INCLUDE [managed-identities](~/includes/managed-identities-conn-strings.md)]
+
 Configuration keys:
 
 * Are case-insensitive. For example, `ConnectionString` and `connectionstring` are treated as equivalent keys.
@@ -436,6 +439,8 @@ The preceding sequence of providers is used in the [default configuration](#defa
 
 ### Connection string prefixes
 
+[!INCLUDE [managed-identities](~/includes/managed-identities-conn-strings.md)]
+
 The Configuration API has special processing rules for four connection string environment variables. These connection strings are involved in configuring Azure connection strings for the app environment. Environment variables with the prefixes shown in the table are loaded into the app with the [default configuration](#default) or when no prefix is supplied to `AddEnvironmentVariables`.
 
 | Connection string prefix | Provider |
diff --git a/aspnetcore/fundamentals/configuration/index/includes/index7.md b/aspnetcore/fundamentals/configuration/index/includes/index7.md
@@ -1,5 +1,5 @@
 :::moniker range="= aspnetcore-7.0" 
-
+<!-- ms.sfi.ropc: t -->
 Application configuration in ASP.NET Core is performed using one or more [configuration providers](#cp). Configuration providers read configuration data from key-value pairs using a variety of configuration sources:
 
 * Settings files, such as `appsettings.json`
@@ -140,6 +140,7 @@ Configuration data guidelines:
 * Never store passwords or other sensitive data in configuration provider code or in plain text configuration files. The [Secret Manager](xref:security/app-secrets) tool can be used to store secrets in development.
 * Don't use production secrets in development or test environments.
 * Specify secrets outside of the project so that they can't be accidentally committed to a source code repository.
+* Production apps should use the most secure authentication flow available. For more information, see [Secure authentication flows](xref:security/index#secure-authentication-flows).
 
 By [default](#default), the user secrets configuration source is registered after the JSON configuration sources. Therefore, user secrets keys take precedence over keys in `appsettings.json` and `appsettings.{Environment}.json`.
 
@@ -390,6 +391,8 @@ The preferred way to read hierarchical configuration data is using the options p
 
 ## Configuration keys and values
 
+[!INCLUDE [managed-identities](~/includes/managed-identities-conn-strings.md)]
+
 Configuration keys:
 
 * Are case-insensitive. For example, `ConnectionString` and `connectionstring` are treated as equivalent keys.
@@ -441,6 +444,8 @@ The preceding sequence of providers is used in the [default configuration](#defa
 
 ### Connection string prefixes
 
+[!INCLUDE [managed-identities](~/includes/managed-identities-conn-strings.md)]
+
 The Configuration API has special processing rules for four connection string environment variables. These connection strings are involved in configuring Azure connection strings for the app environment. Environment variables with the prefixes shown in the table are loaded into the app with the [default configuration](#default) or when no prefix is supplied to `AddEnvironmentVariables`.
 
 | Connection string prefix | Provider |
diff --git a/aspnetcore/fundamentals/use-http-context.md b/aspnetcore/fundamentals/use-http-context.md
@@ -4,9 +4,11 @@ author: jamesnk
 description: How to use HttpContext in ASP.NET Core.
 monikerRange: '>= aspnetcore-3.1'
 ms.author: wpickett
-ms.date: 01/31/2022
+ms.date: 10/07/2024
 uid: fundamentals/use-httpcontext
 ---
+<!-- ms.sfi.ropc: t -->
+
 # Use HttpContext in ASP.NET Core
 
 [!INCLUDE[](~/includes/not-latest-version.md)]
@@ -28,7 +30,7 @@ Commonly used members on `HttpRequest` include:
 |<xref:Microsoft.AspNetCore.Http.HttpRequest.Headers?displayProperty=nameWithType>|A collection of request headers.|`user-agent=Edge`<br />`x-custom-header=MyValue`|
 |<xref:Microsoft.AspNetCore.Http.HttpRequest.RouteValues?displayProperty=nameWithType>|A collection of route values. The collection is set when the request is matched to a route.|`language=en`<br />`article=getstarted`|
 |<xref:Microsoft.AspNetCore.Http.HttpRequest.Query?displayProperty=nameWithType>|A collection of query values parsed from <xref:Microsoft.AspNetCore.Http.HttpRequest.QueryString>.|`filter=hello`<br />`page=1`|
-|[HttpRequest.ReadFormAsync()](xref:Microsoft.AspNetCore.Http.HttpRequest.ReadFormAsync(System.Threading.CancellationToken))|A method that reads the request body as a form and returns a form values collection. For information about why `ReadFormAsync` should be used to access form data, see [Prefer ReadFormAsync over Request.Form](xref:fundamentals/best-practices#prefer-readformasync-over-requestform).|`email=user@contoso.com`<br />`password=TNkt4taM`|
+|[HttpRequest.ReadFormAsync()](xref:Microsoft.AspNetCore.Http.HttpRequest.ReadFormAsync(System.Threading.CancellationToken))|A method that reads the request body as a form and returns a form values collection. For information about why `ReadFormAsync` should be used to access form data, see [Prefer ReadFormAsync over Request.Form](xref:fundamentals/best-practices#prefer-readformasync-over-requestform).|`email=user@contoso.com`|
 |<xref:Microsoft.AspNetCore.Http.HttpRequest.Body?displayProperty=nameWithType>|A <xref:System.IO.Stream> for reading the request body.|UTF-8 JSON payload|
 
 ### Get request headers
diff --git a/aspnetcore/includes/managed-identities-conn-strings.md b/aspnetcore/includes/managed-identities-conn-strings.md
@@ -0,0 +1,9 @@
+---
+author: tdykstra
+ms.author: tdykstra
+ms.date: 10/16/2024
+ms.topic: include
+---
+<!-- ms.sfi.ropc: t -->
+> [!WARNING]
+> This article shows the use of connection strings. With a local database the user doesn't have to be authenticated, but in production, connection strings sometimes include a password to authenticate. A resource owner password credential (ROPC) is a security risk that should be avoided in production databases. Production apps should use the most secure authentication flow available. For more information on authentication for apps deployed to test or production environments, see [Secure authentication flows](xref:security/index#secure-authentication-flows).
diff --git a/aspnetcore/migration/identity.md b/aspnetcore/migration/identity.md
@@ -3,9 +3,10 @@ title: Migrate Authentication and Identity to ASP.NET Core
 author: ardalis
 description: Learn how to migrate authentication and identity from an ASP.NET MVC project to an ASP.NET Core MVC project.
 ms.author: riande
-ms.date: 3/22/2020
+ms.date: 10/29/2024
 uid: migration/identity
 ---
+<!-- ms.sfi.ropc: t -->
 # Migrate Authentication and Identity to ASP.NET Core
 
 By [Steve Smith](https://ardalis.com/)
@@ -22,6 +23,8 @@ Install the following NuGet packages:
 * `Microsoft.AspNetCore.Authentication.Cookies`
 * `Microsoft.EntityFrameworkCore.SqlServer`
 
+[!INCLUDE [managed-identities](~/includes/managed-identities-conn-strings.md)]
+
 In `Startup.cs`, update the `Startup.ConfigureServices` method to use Entity Framework and Identity services:
 
 ```csharp
diff --git a/aspnetcore/migration/proper-to-2x/membership-to-core-identity.md b/aspnetcore/migration/proper-to-2x/membership-to-core-identity.md
@@ -4,9 +4,10 @@ author: isaacrlevin
 description: Learn how to migrate existing ASP.NET apps using Membership authentication to ASP.NET Core 2.0 Identity.
 ms.author: wpickett
 ms.custom: mvc
-ms.date: 01/10/2019
+ms.date: 10/29/2024
 uid: migration/proper-to-2x/membership-to-core-identity
 ---
+<!-- ms.sfi.ropc: t -->
 # Migrate from ASP.NET Membership authentication to ASP.NET Core 2.0 Identity
 
 By [Isaac Levin](https://isaaclevin.com)
@@ -49,6 +50,8 @@ The fastest way to view the schema for ASP.NET Core 2.0 Identity is to create a
     }
     ```
 
+[!INCLUDE [managed-identities](~/includes/managed-identities-conn-strings.md)]
+
 1. Select **View** > **SQL Server Object Explorer**. Expand the node corresponding to the database name specified in the `ConnectionStrings:DefaultConnection` property of `appsettings.json`.
 
     The `Update-Database` command created the database specified with the schema and any data needed for app initialization. The following image depicts the table structure that's created with the preceding steps.
diff --git a/aspnetcore/security/app-secrets.md b/aspnetcore/security/app-secrets.md
@@ -5,9 +5,10 @@ description: Learn how to store and retrieve sensitive information during the de
 ms.author: tdykstra
 monikerRange: '>= aspnetcore-3.0'
 ms.custom: mvc
-ms.date: 02/23/2024
+ms.date: 10/29/2024
 uid: security/app-secrets
 ---
+<!-- ms.sfi.ropc: t -->
 # Safe storage of app secrets in development in ASP.NET Core
 
 [!INCLUDE[](~/includes/not-latest-version.md)]
diff --git a/aspnetcore/security/app-secrets/includes/app-secrets-3-5.md b/aspnetcore/security/app-secrets/includes/app-secrets-3-5.md
@@ -1,11 +1,13 @@
 :::moniker range="< aspnetcore-6.0"
+<!-- ms.sfi.ropc: t -->
 
 By [Rick Anderson](https://twitter.com/RickAndMSFT), [Kirk Larkin](https://twitter.com/serpent5), [Daniel Roth](https://github.com/danroth27), and [Scott Addie](https://github.com/scottaddie)
 
 [View or download sample code](https://github.com/dotnet/AspNetCore.Docs/tree/main/aspnetcore/security/app-secrets/samples) ([how to download](xref:index#how-to-download-a-sample))
 
-This document explains how to manage sensitive data for an ASP.NET Core app on a development machine. Never store passwords or other sensitive data in source code. Production secrets shouldn't be used for development or test. Secrets shouldn't be deployed with the app. Instead, production secrets should be accessed through a controlled means like environment variables or Azure Key Vault. You can store and protect Azure test and production secrets with the [Azure Key Vault configuration provider](xref:security/key-vault-configuration).
+This article explains how to manage sensitive data for an ASP.NET Core app on a development machine. Never store passwords or other sensitive data in source code or configuration files. Production secrets shouldn't be used for development or test. Secrets shouldn't be deployed with the app. Production secrets should be accessed through a controlled means like Azure Key Vault. Azure test and production secrets can be stored and protected with the [Azure Key Vault configuration provider](xref:security/key-vault-configuration).
 
+For more information on authentication for test and production environments, see [Secure authentication flows](xref:security/index#secure-authentication-flows).
 ## Environment variables
 
 Environment variables are used to avoid storage of app secrets in code or in local configuration files. Environment variables override configuration values for all previously specified configuration sources.
diff --git a/aspnetcore/security/authentication/customize-identity-model.md b/aspnetcore/security/authentication/customize-identity-model.md
@@ -3,9 +3,10 @@ title: Identity model customization in ASP.NET Core
 author: ajcvickers
 description: This article describes how to customize the underlying Entity Framework Core data model for ASP.NET Core Identity.
 ms.author: avickers
-ms.date: 07/01/2019
+ms.date: 10/29/2024
 uid: security/authentication/customize_identity_model
 ---
+<!-- ms.sfi.ropc: t -->
 # Identity model customization in ASP.NET Core
 
 By [Arthur Vickers](https://github.com/ajcvickers)
@@ -887,6 +888,8 @@ services
 
 Refer to the preceding examples for guidance on adding navigation properties to the entity types.
 
+[!INCLUDE [managed-identities](~/includes/managed-identities-conn-strings.md)]
+
 ## Additional resources
 
 * <xref:security/authentication/scaffold-identity>
diff --git a/aspnetcore/security/authentication/identity-api-authorization/includes/identity-api-authorization3-7.md b/aspnetcore/security/authentication/identity-api-authorization/includes/identity-api-authorization3-7.md
@@ -1,4 +1,5 @@
 :::moniker range=">= aspnetcore-6.0 < aspnetcore-8.0"
+<!-- ms.sfi.ropc: t -->
 
 The ASP.NET Core templates offer authentication in Single Page Apps (SPAs) using the support for API authorization. ASP.NET Core Identity for authenticating and storing users is combined with [Duende Identity Server](https://docs.duendesoftware.com) for implementing OpenID Connect.
 
@@ -76,6 +77,8 @@ The preceding code configures:
     app.UseIdentityServer();
     ```
 
+[!INCLUDE [managed-identities](~/includes/managed-identities-conn-strings.md)]
+
 ### Azure App Service on Linux
 
 For Azure App Service deployments on Linux, specify the issuer explicitly:
@@ -484,6 +487,8 @@ The `Startup` class has the following additions:
     app.UseIdentityServer();
     ```
 
+[!INCLUDE [managed-identities](~/includes/managed-identities-conn-strings.md)]
+
 ### Azure App Service on Linux
 
 For Azure App Service deployments on Linux, specify the issuer explicitly in `Startup.ConfigureServices`:
diff --git a/aspnetcore/security/authentication/identity-custom-storage-providers.md b/aspnetcore/security/authentication/identity-custom-storage-providers.md
@@ -4,9 +4,10 @@ author: ardalis
 description: Learn how to configure custom storage providers for ASP.NET Core Identity.
 ms.author: riande
 ms.custom: mvc
-ms.date: 07/23/2019
+ms.date: 10/29/2024
 uid: security/authentication/identity-custom-storage-providers
 ---
+<!-- ms.sfi.ropc: t -->
 # Custom storage providers for ASP.NET Core Identity
 
 By [Steve Smith](https://ardalis.com/)
@@ -207,6 +208,8 @@ Once you have implemented a storage provider, you configure your app to use it.
 1. If you are using Roles, update the `RoleManager` to use your `RoleStore` class.
 1. Update the connection string and credentials to your app's configuration.
 
+[!INCLUDE [managed-identities](~/includes/managed-identities-conn-strings.md)]
+
 Example:
 
 :::moniker range="< aspnetcore-6.0"
diff --git a/aspnetcore/security/authentication/mfa.md b/aspnetcore/security/authentication/mfa.md
@@ -5,9 +5,10 @@ description: Learn how to set up multi-factor authentication (MFA) in an ASP.NET
 monikerRange: '>= aspnetcore-3.1'
 ms.author: riande
 ms.custom: mvc
-ms.date: 04/02/2024
+ms.date: 10/29/2024
 uid: security/authentication/mfa
 ---
+<!-- ms.sfi.ropc: t -->
 # Multi-factor authentication in ASP.NET Core
 
 [!INCLUDE[](~/includes/not-latest-version.md)]
@@ -73,6 +74,8 @@ MFA could be forced on users to access sensitive pages within an ASP.NET Core Id
 
 The demo code is setup using ASP.NET Core with Identity and Razor Pages. The `AddIdentity` method is used instead of `AddDefaultIdentity` one, so an `IUserClaimsPrincipalFactory` implementation can be used to add claims to the identity after a successful login.
 
+[!INCLUDE [managed-identities](~/includes/managed-identities-conn-strings.md)]
+
 ```csharp
 builder.Services.AddDbContext<ApplicationDbContext>(options =>
     options.UseSqlite(
diff --git a/aspnetcore/security/authentication/mfa/includes/mfa-5-8.md b/aspnetcore/security/authentication/mfa/includes/mfa-5-8.md
@@ -59,6 +59,8 @@ MFA could be forced on users to access sensitive pages within an ASP.NET Core Id
 
 The demo code is setup using ASP.NET Core with Identity and Razor Pages. The `AddIdentity` method is used instead of `AddDefaultIdentity` one, so an `IUserClaimsPrincipalFactory` implementation can be used to add claims to the identity after a successful login.
 
+[!INCLUDE [managed-identities](~/includes/managed-identities-conn-strings.md)]
+
 ```csharp
 builder.Services.AddDbContext<ApplicationDbContext>(options =>
     options.UseSqlite(
@@ -561,6 +563,8 @@ MFA could be forced on users to access sensitive pages within an ASP.NET Core Id
 
 The demo code is setup using ASP.NET Core with Identity and Razor Pages. The `AddIdentity` method is used instead of `AddDefaultIdentity` one, so an `IUserClaimsPrincipalFactory` implementation can be used to add claims to the identity after a successful login.
 
+[!INCLUDE [managed-identities](~/includes/managed-identities-conn-strings.md)]
+
 ```csharp
 public void ConfigureServices(IServiceCollection services)
 {
diff --git a/aspnetcore/security/data-protection/implementation/key-storage-providers.md b/aspnetcore/security/data-protection/implementation/key-storage-providers.md
diff --git a/aspnetcore/security/key-vault-configuration.md b/aspnetcore/security/key-vault-configuration.md
