[docs] Document dashboard cookie scoping by application name - #1719
Closed
aspire-repo-bot[bot] wants to merge 2 commits into
Closed
aspire-repo-bot[bot] wants to merge 2 commits into
aspire-repo-bot[bot] wants to merge 2 commits into
Conversation
Documents the application-name-based cookie scoping introduced in microsoft/aspire#20299: authentication (browser-token and OpenID Connect) and antiforgery cookie names now include a suffix derived from Dashboard:ApplicationName, so dashboards with different application names no longer share cookies. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
aspire-repo-bot
Bot
added
the
docs-from-code
5 of 14 tasks
Contributor
Author
Frontend HTML artifact readyThe latest frontend build uploaded the This comment updates automatically when a new frontend build artifact is uploaded. |
David Pine (IEvangelist)
requested a review
from James Newton-King (JamesNK)
September 23, 2026 16:53
David Pine (IEvangelist)
marked this pull request as ready for review
September 23, 2026 16:53
Copilot started reviewing on behalf of
David Pine (IEvangelist)
September 23, 2026 16:54
View session
Contributor
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
Cookie-scope wording still needs qualification, and the review assessments do not establish safe automated approval.
Review effort: Lite
Findings: 1
Open (1)
What changed in this PR
Documents how Dashboard:ApplicationName scopes dashboard cookies and persisted data.
Changes:
- Adds cookie-scoping guidance and compatibility notes.
- Updates the configuration reference with cookie behavior and cross-references.
| File | Description |
|---|---|
src/frontend/src/content/docs/dashboard/security-considerations.mdx |
Adds cookie-scoping guidance, naming, session effects, and storage references. |
src/frontend/src/content/docs/dashboard/configuration.mdx |
Documents cookie scoping for Dashboard:ApplicationName. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
David Pine (IEvangelist)
left a comment
David Pine (IEvangelist)
left a comment
Member
There was a problem hiding this comment.
Docs-accuracy review — automated (hourly)
Phase A source of truth: target branch is release/13.6 (tip 63b5556c7f4de9b259d6ba71a312f597a72bf307). The source change is microsoft/aspire#20299 ("Scope dashboard cookies and resource state by application name").
Important
Backport gap: microsoft/aspire#20299 is merged to main (commit 410b067ce5, milestone 13.6) but is not yet backported to release/13.6 — the branch this docs PR targets. Every behavioral claim below was verified accurate against the source PR on main, but the code is not present on the target release branch at review time. Please make sure #20299 lands on release/13.6 before (or with) this docs PR, otherwise the published 13.6 docs would describe behavior that hasn't shipped on that branch.
Claims extracted: 12 non-narrative — all verified against source (main), 0 contradicted. On the target release/13.6 branch they are currently unverifiable (pending backport).
Phase B (doc-tester): exercised /dashboard/security-considerations/ and /dashboard/configuration/; both internal cross-references validate in-repo. 0 critical, 0 warnings.
Verdict: COMMENT — the documentation content is factually accurate against the source PR, but I can't approve because the described behavior isn't on the target release/13.6 branch yet (see backport note). No contradictions and no Phase B critical issues were found.
Phase A — Claim verification
Verified against microsoft/aspire#20299 @ 410b067ce5 on main. Key source files: DashboardApplicationNameKey.cs, DashboardAuthenticationCookieNames.cs, DashboardWebApplication.cs, Configuration/DashboardOptions.cs, Utils/BrowserStorageKeys.cs.
✅ Verified-against-source claims (12)
-
Dashboard:ApplicationNamealso scopes cookie names (config row) — defaultAspireand now scopes auth + antiforgery cookie names in addition to partitioning persisted data. Evidence:DashboardOptions.DefaultApplicationName = "Aspire"; cookie wiring below. -
Suffix derivation — "lowercase, cookie-safe prefix of up to 32 characters + a hash of the full application name; names differing only in case, spacing, or punctuation still get distinct cookies." Evidence:
DashboardApplicationNameKey.Create—maxApplicationNameLength = 32, keeps[a-zA-Z0-9-_]else replaces with-,Trim('-','_'),ToLowerInvariant(), then appendsXxHash3.Hash(UTF8 bytes of the full, original applicationName). The hash is over the untruncated original, so case/space/punctuation differences yield different hashes. -
Three cookie types carry the suffix — browser-token, OpenID Connect, and antiforgery. Evidence:
DashboardWebApplication.cs— antiforgeryoptions.Cookie.Name = $"{".Aspire.Dashboard.Antiforgery"}.{applicationNameKey}"; both the OIDC and browser-tokenAddCookiebranches setoptions.Cookie.Name = authCookieNamefromDashboardAuthenticationCookieNames.Create(...). -
Example cookie names —
My application→.Aspire.Dashboard.Auth.my-application-<hash>and.Aspire.Dashboard.Antiforgery.my-application-<hash>. Evidence:AuthCookieNamePrefix = ".Aspire.Dashboard.Auth", antiforgery prefix.Aspire.Dashboard.Antiforgery, and the suffix for "My application" sanitizes/lowercases tomy-application-<hash>. Exact match. -
Same name ⇒ shared cookies / sign-in —
Createis a deterministic function of the application name. -
Change name ⇒ new cookie names ⇒ re-sign-in — a different name produces a different suffix, so the previous auth cookie is no longer read.
-
Non-cryptographic hash — the suffix hash is
System.IO.Hashing.XxHash3, a naming hash, not an auth/integrity mechanism. -
Time format stays shared across origin —
BrowserStorageKeys.TimeFormat = "Aspire_TimeFormat"is a plain unscoped key (no application-name suffix), unlike the collapsed-resource key. -
Collapsed-resource state follows the resource-service-reported name —
Resources.razor.cscallsBrowserStorageKeys.CollapsedResourceNamesKey(DashboardClient.ApplicationName);DashboardClient.ApplicationNameprefers the service-reported_applicationNameover the configured_dashboardOptions.GetApplicationNameOrDefault(), so it can differ from the configuredDashboard:ApplicationNameused for cookies and disk persistence. -
ASPIRE_DASHBOARD_APPLICATION_NAMEsetsDashboard:ApplicationName— standard config mapping; text unchanged by this PR. -
Cookies shared across ports on the same hostname — accurate general browser behavior underpinning the feature (cookies are not port-scoped).
-
Cross-references —
#cookie-scoping-by-application-name(new self-anchor in this PR) and/dashboard/data-persistence/#storage-layoutboth resolve in-repo (see Phase B).
Phase B — Doc-tester results (blind-user pass)
Routes exercised: /dashboard/security-considerations/, /dashboard/configuration/.
- Critical issues: none.
- Warnings: none.
- Passed checks:
security-considerationsrenders; the new## Cookie scoping by application namesection has a coherent insertion point — it lands between the allow-anonymous Danger callout and the## Secure telemetry endpointheading, continuing the security discussion.configurationrenders; the updatedDashboard:ApplicationNamerow (new "scope authentication and antiforgery cookie names" text + cross-reference link) is present in the PR head content.- Cross-reference
/dashboard/data-persistence/#storage-layout— target pagedata-persistence.mdxexists onrelease/13.6and contains a## Storage layoutheading (anchorstorage-layout). Valid. - Self cross-reference
#cookie-scoping-by-application-name— matches the new H2 added by this PR. Valid.
- Recommendations: none.
- Knowledge gaps: the
release/13.6docs build is not published, so the live site still shows pre-PR content —/dashboard/data-persistence/currently 404s live and the updated config row isn't on the published site yet. This is expected for unpublished release content and doesn't indicate a defect. The new section's prose and the underlying cookie-scoping runtime behavior can't be exercised from the docs site; Phase A covers those against source.
Automated docs-from-code accuracy review. Phase A reads microsoft/aspire release source; Phase B validates the docs site as a new user via Playwright.
15 of 17 tasks
David Pine (IEvangelist)
added a commit
that referenced
this pull request
Sep 28, 2026
…ps (#1780) ## Summary <!-- Describe what this pull request changes and why. --> Reconcile the 13.6 wiki audit and **all 25 open `docs-from-code` proposals targeting `release/13.6`** against the actual release source. Add missing canonical guidance rather than putting all coverage in What's new. This is a new, isolated feature PR into `release/13.6`; it does not update the release rollup #1599, merge or close another proposal, or push directly to a release branch. **Draft with explicit remaining packaging/validation gates:** the six REPL walkthroughs are source-verified, but current publicly available 13.6 packages do not contain the late `WithRepl` exports. Generated API catalogs have deliberately not been fabricated or refreshed from 14.x. See the open checklist below. ### Evidence baseline - Documentation base: `717442f6666948bcf77f3d704dc2dadf7c080ec2`. - Product source of truth: [`microsoft/aspire@e8fd6fbb954f50ccd2e66479538392f65e13e71d`](https://github.com/microsoft/aspire/tree/e8fd6fbb954f50ccd2e66479538392f65e13e71d), current `release/13.6` at audit time. Source was read from that Git object, not the stale source working directory. - [13.6 wiki](https://github.com/microsoft/aspire/wiki/13.6-Change-log) snapshot `8e01a371d4f16a1306e48174d4cf1fdeca714348`, whose cutoff is product PR 20511. Later backports 20541/20546/20548 are included here. - Proposal base branches alone were **not** used as proof of release membership. Direct ancestry and known release backports were checked. Four fallback-targeted proposals are excluded below. - Wiki link corrections: its REPL link #1752 actually covers Sandboxes; the REPL proposal is #1740. Its AOT link #1714 covers PFX certificates, not AOT. ### Complete audit-gap checklist Checked items mean documentation coverage is implemented, not that cloud deployment or every product runtime scenario was executed. - [x] **1. Dotnet API graduation:** correct removal to **13.6**, not 14.0, in What's new, both Dotnet guides, and the diagnostic page; preserve the prerelease package caveat. This applies to core `AddDotnetProject`, `DotnetProjectResource`, and related `WithBuildEnvironment` overloads, not all uses of the diagnostic. Source: microsoft/aspire#20496. - [x] **2. Sandboxes:** remove obsolete API suppressions in the article and deployment guide while preserving Azure service preview/access and prerelease package limitations. Source: microsoft/aspire#20483. - [x] **3. Docked REPL documentation:** all six PostgreSQL/MySQL/MongoDB/SQL Server/Redis/Valkey guides plus the article now cover opt-in `WithRepl`/`withRepl`, run-only availability, actual client privileges, credential handling, and explicit exit versus closing a viewer. Source: microsoft/aspire#20419, backport of microsoft/aspire#20231. Package-backed checks remain open below. - [x] **4. Terminal CLI flag:** update current 13.6 article, `with-terminal`, and all three terminal command references. Preserve `terminals.v1` and experimental hosting API distinctions. Current configuration/schema data had no flag entry to remove; historical 13.5 notes remain historical. Source: microsoft/aspire#20548. - [x] **5. First-party Rust:** rewrite both canonical Rust guides around `Aspire.Hosting.Rust`; document Cargo versus application arguments, typed targets, debugging, generated Dockerfiles, workspace context, ABI constraints, and Toolkit migration. Bacon remains explicitly Toolkit-only. Add exact first-party package mapping. Source: microsoft/aspire#18906 and current Rust README. - [x] **6. Agent setup:** align command reference, skills guide, AI-agent guide, and article on MCP opt-in, `--mcp`, chained/non-interactive behavior, seven-skill catalog, Project v2 migration, and Copilot app detection. Also fix stale default-selection text: all applicable bundle skills are preselected; companion tools remain opt-in. Sources: microsoft/aspire#19893, microsoft/aspire#20405, microsoft/aspire#19820. - [x] **7. Deno AppHost runtime:** document Deno 2+ detection, commands, permissions, native watch/type checking, doctor, and `DENO_CERT`, separately from Deno guest hosting. Source: microsoft/aspire#18627, distinct from microsoft/aspire#18628. - [x] **8. Native AOT / Fluent UI v5:** concise article, dashboard exploration, and standalone guidance; automatic packaged-dashboard selection, no invented performance figures. Source: microsoft/aspire#19565 and release packaging sources. - [x] **9. NuGet:** document bundled in-process operations, credential providers, non-interactive authentication, and realistic troubleshooting. Correct the proposal's `dotnet nuget locals` authentication advice: cache commands do not authenticate a feed. Source: microsoft/aspire#20391. - [x] **10. Multithreaded builds:** article and coordinated-build guide explain `-mt`, SDK detection, distinct project/file-based SDK floors, and fallback. Source: microsoft/aspire#20441. - [x] **11. Radius:** add a real deployment guide with C#/TypeScript setup, recipe-backed connections versus local endpoints, per-resource credential behavior, unauthenticated Redis limitation, secret exposure boundaries, and actionable runtime diagnostics 070–091. Wire navigation and exact package mapping. Source: microsoft/aspire#19555 and release README. - [x] **12. Connection aliases:** replace contradictory no-encoding guidance, retain composed logical-key-first lookup and portable-target behavior, explain collision detection and custom-publisher metadata. Source: microsoft/aspire#19729. - [x] **13. Connector Namespace / Toolbox / provisioning:** add Connector Namespace walkthrough, security/consent/revocation limits and mapping/sidebar; add Foundry Toolbox walkthrough, connection properties, roles, index prerequisites, approval enforcement boundaries, immutable versions, and existing-resource behavior. Extend existing Azure provisioning guide without a duplicate page. Sources: microsoft/aspire#19024, microsoft/aspire#17742, microsoft/aspire#20131. - [x] **14. Remaining high-impact items:** article covers opt-in manifest-aware DNX and new-template CLI bundling (existing SDK guides retained), migration skill and Copilot app detection; canonical inline `CsiVolumeSourceV1`/`VolumeV1.Csi` example, management links, Cosmos vNext telemetry, and AI Inference `GetModelInfoAsync`/`/info` health checks with `DisableHealthChecks`. No Azure OpenAI health-check claim. Sources: microsoft/aspire#19310, microsoft/aspire#19076, microsoft/aspire#19826, microsoft/aspire#20070, microsoft/aspire#15671, microsoft/aspire#15969. - [x] **15. All 25 proposal dispositions:** listed below, including newer dashboard backports and four exclusions. Existing Sandbox inference coverage is retained rather than copied from a stale draft. - [ ] **16. Refresh generated API/catalog/Twoslash data from an official post-backport 13.6 build.** Existing `26473.12`/`a11eca96` data remains untouched. The newest public `dotnet9` feed package checked, `13.6.0-preview.1.26474.10` at `43496a2a306c81c862c947b11b4f4e5494b6fe08`, still has no Redis `WithRepl` in its actual package XML. Do not use 14.x, hand-edit declarations, or attribute source changes to older binaries. - [ ] **Validate the six REPL examples against that actual post-backport SDK and running clients.** Their new TypeScript fences are plain TypeScript, not annotated with unsupported Twoslash data. No existing diagnostics are allowlisted or suppressed; no generated API exports are fabricated. Enable Twoslash when the genuine catalog catches up. ### All 25 open proposal dispositions and provenance Text is selectively adapted from these proposals, not merged wholesale. #1778 and #1748 are authored by @sebastienros; the other proposals are authored by the Aspire repo bot. The table credits the associated product-change authors where supplied by the proposals. Existing PRs remain open and unchanged. | Docs PR | Release source / credited product author | Disposition | | --- | --- | --- | | #1778 | microsoft/aspire#19729 — @sebastienros | **Adopted:** canonical connection-string alias correction, including logical-first resolution and migration. | | #1771 | microsoft/aspire#20481 — @sebastienros | **Excluded:** flat polyglot feature keys are not in the audited release tip; no verified backport. Preserve release key names. | | #1770 | microsoft/aspire#20525 → microsoft/aspire#20548 — @mitchdenny | **Corrected/adopted:** command guides plus the still-current 13.6 article, which the proposal incorrectly treats as historical. | | #1769 | microsoft/aspire#20416 — @JamesNK | **Excluded:** brand hover change has no verified 13.6 membership/backport. | | #1768 | microsoft/aspire#20523 → microsoft/aspire#20546 — @JamesNK | **Adopted:** run pin/unpin preserves selector and current selection. | | #1766 | microsoft/aspire#20537 → microsoft/aspire#20541 — @mitchdenny | **Adopted:** terminal dock empty state. | | #1761 | microsoft/aspire#20490 → microsoft/aspire#20496 — @eerhardt | **Corrected:** graduation is 13.6, package remains prerelease, Blazor-specific exception retained. | | #1760 | microsoft/aspire#20436 — @eerhardt | **Excluded:** CLI net11/tools-any retarget is not in the audited release; no fallback-base inference. | | #1748 | microsoft/aspire#20131 — @sebastienros | **Adopted:** extend existing provisioning guide with service-specific models/lookups and projection limits. | | #1744 | microsoft/aspire#20337 → microsoft/aspire#20441 — @karolz-ms | **Adopted:** precise SDK-conditional multithreaded build coverage. | | #1740 | microsoft/aspire#20231 → microsoft/aspire#20419 — @mitchdenny | **Adapted:** all six guides; TypeScript-first tabs, source-verified lifecycle/security. Actual post-backport SDK/runtime gate is open above. | | #1738 | microsoft/aspire#20158 → microsoft/aspire#20405 — @karolz-ms | **Partly already covered / completed:** existing seven-skill catalog retained; add project migration guidance and correct command catalog/defaults. Do not misclassify the bundled skill as a companion tool. | | #1735 | microsoft/aspire#20334 — @karolz-ms | **Excluded:** enhanced startup errors are not in the audited release; no verified backport. | | #1731 | microsoft/aspire#19847 → microsoft/aspire#20391 — @eerhardt | **Corrected/adopted:** in-process NuGet and real authenticated-restore troubleshooting, not cache-command authentication. | | #1719 | microsoft/aspire#20299 → microsoft/aspire#20407 — @JamesNK | **Corrected/adopted:** cookie naming/scoping; identical names can collide but do not guarantee cross-dashboard cookie decryptability or shared sign-in. | | #1664 | microsoft/aspire#20011 — @maddymontaquila | **Adopted:** concise Azure environment icon release note. | | #1628 | microsoft/aspire#17742 — @davidfowl | **Adapted/expanded:** canonical Toolbox examples, consumer contract, role/index prerequisites, approval/security and concurrency limits. | | #1623 | microsoft/aspire#19810 — @mitchdenny | **Already covered:** current Sandbox guide/article already describe compute inference, explicit selection and external endpoints. Preserve that guidance while removing obsolete suppressions. | | #1620 | microsoft/aspire#19243 — @sebastienros | **Adapted:** AKS credential-before-Helm cleanup and destructive-operation warning; omit misleading ambient-context workaround. | | #1614 | microsoft/aspire#19870 — @sebastienros | **Adopted:** typed callback handle behavior in extension authoring and article. | | #1574 | microsoft/aspire#19430 — @mitchdenny | **Adapted:** canonical hostname inheritance, explicit-host precedence, catch-all default backend. | | #1570 | microsoft/aspire#19590 — @karolz-ms | **Adopted:** Dev Tunnel URL regression troubleshooting. | | #1565 | microsoft/aspire#19429 — @mitchdenny | **Corrected/adopted:** Helm embedded parameters with real `refExpr` and `addParameter(name, { value })`, not stringifying a handle or using an invalid actual-SDK overload. | | #1564 | microsoft/aspire#19026 — @karolz-ms | **Corrected/adopted:** C#/TypeScript Dotnet gateway walkthrough. Retain both experimental diagnostics; remove obsolete run-only restriction after microsoft/aspire#19997 publishing support. Avoid imported ambiguous API reference. | | #1499 | microsoft/aspire#19248 — @IEvangelist | **Adopted:** describe exact secret-value redaction and embedded-secret limit; release article already covered the fix. | ### Important source-verified corrections to proposals / earlier audit assumptions - [`BlazorGatewayExtensions.cs`](https://github.com/microsoft/aspire/blob/e8fd6fbb954f50ccd2e66479538392f65e13e71d/src/Aspire.Hosting.Blazor/BlazorGatewayExtensions.cs): `AddDotnetProjectBlazorGateway` and the Dotnet `WithBlazorClientApp` overload still carry `ASPIREDOTNETPROJECT001`; the class carries `ASPIREBLAZOR001`. They share `WithBlazorClientAppCore`/`WithBlazorApp` and the publish-companion path. Thus neither blanket diagnostic retirement nor the proposal's old run-only claim is correct. - [`SkillDefinition.cs`](https://github.com/microsoft/aspire/blob/e8fd6fbb954f50ccd2e66479538392f65e13e71d/src/Aspire.Cli/Agents/SkillDefinition.cs) sets bundled skills' `IsDefault=true`; [`AgentInitCommand.cs`](https://github.com/microsoft/aspire/blob/e8fd6fbb954f50ccd2e66479538392f65e13e71d/src/Aspire.Cli/Commands/AgentInitCommand.cs) selects the applicable catalog defaults for both flows. MCP has its own standalone-only binding. - [`TypeScriptAppHostToolchainResolver.cs`](https://github.com/microsoft/aspire/blob/e8fd6fbb954f50ccd2e66479538392f65e13e71d/src/Aspire.Cli/Projects/TypeScriptAppHostToolchainResolver.cs) is the source for Deno flags and certificate variable; guest Deno hosting is separate. - [`Radius README`](https://github.com/microsoft/aspire/blob/e8fd6fbb954f50ccd2e66479538392f65e13e71d/src/Aspire.Hosting.Radius/README.md) supplies the resource-specific credential rules and publish diagnostics, not assumptions about local endpoints. ## Third-party links and affiliations <!-- List third-party links and disclose material affiliations. --> Links point to official Microsoft Learn, VS Code Marketplace debugger extensions, Rust/Cargo/Bacon documentation, Radius documentation, and source repositories. No sponsorship, commercial endorsement, or affiliation claim is introduced. Maintainers should supply any personal affiliation disclosure required by policy; automation has not inferred one. ## Validation <!-- List the checks you ran or explain why validation isn't needed. --> - **97 passing focused unit checks** across API-reference authoring/rendering, Twoslash blocks, file-tree formatting, CLI configuration schema, SEO lengths, and resource catalog. - **82 passing structured-data checks**, including exact integration mapping uniqueness and page resolution. - **11 C# samples compile**, zero warnings/errors, using genuine `13.6.0-preview.1.26473.12` packages. Scope: Rust, Connector Namespace, Radius, Toolbox, inline CSI, Helm, Blazor gateway, and provisioning. `Projects.Api/Worker/Client` use compile-only `IProjectMetadata` stand-ins; no claim of running those apps or provisioning cloud resources. - **10 TypeScript samples pass `tsc`** under `strict`, `NodeNext`, and `ES2022` against three **unmodified actual SDK files**, not just the site's declaration bundle. The fixture uses the exact `e8fd6fbb` release `AtsCapabilityScanner` and genuine `26473.12` TypeSystem/code-generator/integration binaries, whose informational source is `a11eca96`. This is an isolated local generation fixture, **not** a claim that official CLI generation or a new packaged release was tested. An attempted restore with the older handed-off local CLI could not discover an AppHost server; the bounded direct generator fixture was used instead. - The SDK scan is **not globally warning-free**: it reports a Radius `withContainerImage` collision on `CSharpAppResource` and an App Configuration `createRoleAssignment` overload collision. None of the compiled examples calls those colliding methods; the warnings are retained in evidence, not suppressed, and no generated declarations were edited. - Browser: Connector Namespace, Radius, both Rust pages, Foundry hosting, and What's new return **HTTP 200**, correct headings, and no rendered Twoslash errors. New guide/article page-local anchors and the cross-page Blazor anchor resolve. Connector/Radius mobile layouts have no horizontal overflow; Connector language-tab interaction works. Standalone Astro preview emits expected `/api/live` 404s because StaticHost is not running. - `git diff --check` passes. No production `pnpm build`, cloud deployment, REPL runtime session, full product suite, or blanket validation of every pre-existing example was performed. - Generated C#/TypeScript API data, declaration bundles, integration catalogs, image catalogs, and contributor data are unchanged. Only the authored package-to-guide mapping is updated. **Before merging:** complete the two packaging/REPL checkboxes above, inspect CI, and obtain human review. This PR intentionally does not close or merge the source documentation proposals. --------- Co-authored-by: David Pine <7679720+IEvangelist@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
James Newton-King (JamesNK)
approved these changes
Sep 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents changes from microsoft/aspire#20299.
@JamesNKTarget branch
Targeting
release/13.6based on the source PR milestone13.6.Why this is needed
The source PR scopes the dashboard's authentication (browser-token and OpenID Connect) and antiforgery cookie names, and its collapsed-resource local-storage keys, by
Dashboard:ApplicationName. This is a user-facing configuration behavior change (PR body includes a "Usage and compatibility" section describing the new cookie-name format and the sign-in/reset impact of changing the application name), but the docs previously only describedDashboard:ApplicationNameas a data-partitioning setting.What changed
dashboard/configuration.mdx: Updated theDashboard:ApplicationNameoption description to mention that it also scopes authentication and antiforgery cookie names, with a link to the new security-considerations section.dashboard/security-considerations.mdx: Added a new "Cookie scoping by application name" section explaining:data-persistence.mdx#storage-layoutsection, which already documents the related collapsed-resource storage-key scoping.No new pages were created; both edits are to existing pages.