Stop the apphost from running if the application url is http and ASPIRE_ALLOW_UNSECURED_TRANSPORT is not set

playground/TestShop/AppHost/Properties/launchSettings.json

@@ -1,29 +1,31 @@
 {
   "profiles": {
-    "http": {
+    "https": {
       "commandName": "Project",
       "launchBrowser": true,
       "dotnetRunMessages": true,
-      "applicationUrl": "http://localhost:15888",
+      "applicationUrl": "https://localhost:15887;http://localhost:15888",
       "environmentVariables": {
         "ASPNETCORE_ENVIRONMENT": "Development",
         "DOTNET_ENVIRONMENT": "Development",
-        "DOTNET_DASHBOARD_OTLP_ENDPOINT_URL": "http://localhost:16031",
-        "DOTNET_RESOURCE_SERVICE_ENDPOINT_URL": "http://localhost:17031",
-        "DOTNET_ASPIRE_SHOW_DASHBOARD_RESOURCES": "true"
+        "DOTNET_DASHBOARD_OTLP_ENDPOINT_URL": "https://localhost:16037",
+        "DOTNET_RESOURCE_SERVICE_ENDPOINT_URL": "https://localhost:17037",
+        "DOTNET_ASPIRE_SHOW_DASHBOARD_RESOURCES": "true",
+        "ASPIRE__DASHBOARD__AUTHENTICATION__BROWSERTOKEN": "ABC123"
       }
     },
-    "https": {
+    "http": {
       "commandName": "Project",
       "launchBrowser": true,
       "dotnetRunMessages": true,
-      "applicationUrl": "https://localhost:15887;http://localhost:15888",
+      "applicationUrl": "http://localhost:15888",
       "environmentVariables": {
         "ASPNETCORE_ENVIRONMENT": "Development",
         "DOTNET_ENVIRONMENT": "Development",
-        "DOTNET_DASHBOARD_OTLP_ENDPOINT_URL": "https://localhost:16037",
-        "DOTNET_RESOURCE_SERVICE_ENDPOINT_URL": "https://localhost:17037",
-        "DOTNET_ASPIRE_SHOW_DASHBOARD_RESOURCES": "true"
+        "DOTNET_DASHBOARD_OTLP_ENDPOINT_URL": "http://localhost:16031",
+        "DOTNET_RESOURCE_SERVICE_ENDPOINT_URL": "http://localhost:17031",
+        "DOTNET_ASPIRE_SHOW_DASHBOARD_RESOURCES": "true",
+        //"ASPIRE__DASHBOARD__AUTHENTICATION__ALLOWUNSECURETRANSPORT": "true"
       }
     },
     "generate-manifest": {

playground/TestShop/AppHost/appsettings.json

@@ -3,7 +3,7 @@
     "LogLevel": {
       "Default": "Information",
       "Microsoft.AspNetCore": "Warning",
-      "Aspire.Hosting.Dcp": "Warning"
+      "Aspire.Hosting.Dcp": "Debug"
     }
   }
 }

src/Aspire.Hosting/Aspire.Hosting.csproj

@@ -18,6 +18,7 @@
     <Compile Include="$(SharedDir)IConfigurationExtensions.cs" Link="Utils\IConfigurationExtensions.cs" />
     <Compile Include="$(SharedDir)KnownFormats.cs" Link="Utils\KnownFormats.cs" />
     <Compile Include="$(SharedDir)KnownResourceNames.cs" Link="Utils\KnownResourceNames.cs" />
+    <Compile Include="$(SharedDir)KnownEnvironmentVariables.cs" Link="Utils\KnownEnvironmentVariables.cs" />
     <Compile Include="$(SharedDir)PathNormalizer.cs" Link="Utils\PathNormalizer.cs" />
     <Compile Include="$(SharedDir)StringComparers.cs" Link="Utils\StringComparers.cs" />
     <Compile Include="$(SharedDir)TaskHelpers.cs" Link="Utils\TaskHelpers.cs" />

src/Aspire.Hosting/Dashboard/DashboardAuthenticationOptions.cs

@@ -0,0 +1,10 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+namespace Aspire.Hosting.Dashboard;
+
+internal class DashboardAuthenticationOptions
+{
+    public bool? AllowUnsecureTransport { get; set; }
+    public string? BrowserToken { get; set; }
+}

src/Aspire.Hosting/Dashboard/DashboardAuthenticationOptionsValidator.cs

@@ -0,0 +1,33 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Options;
+
+namespace Aspire.Hosting.Dashboard;
+
+internal class DashboardAuthenticationOptionsValidator(IConfiguration configuration) : IValidateOptions<DashboardAuthenticationOptions>
+{
+    public ValidateOptionsResult Validate(string? name, DashboardAuthenticationOptions options)
+    {
+        if (configuration[KnownEnvironmentVariables.AspNetCoreUrls] is not { } applicationUrls)
+        {
+            throw new DistributedApplicationException($"AppHost does not have applicationUrl in launch profile, or {KnownEnvironmentVariables.AspNetCoreUrls} environment variable set.");
+        }
+
+        var firstApplicationUrl = applicationUrls.Split(";").First();
+
+        if (!Uri.TryCreate(firstApplicationUrl, UriKind.Absolute, out var parsedFirstApplicationUrl))
+        {
+            throw new DistributedApplicationException($"AppHost applicationUrl in launch profile, or {KnownEnvironmentVariables.AspNetCoreUrls} environment variable could not be parsed as a URI.");
+        }
+
+        if (parsedFirstApplicationUrl.Scheme == "http" && !options.AllowUnsecureTransport.GetValueOrDefault(false))
+        {
+            throw new DistributedApplicationException($"AppHost cannot use a non-TLS URL for applicationUrl in launch profile, or {KnownEnvironmentVariables.AspNetCoreUrls} unless DashboardAuthenticationOptions.AllowUnsecureTransport is set to true.");
+        }
+
+        _ = configuration;
+        return ValidateOptionsResult.Success;
+    }
+}

src/Aspire.Hosting/Dashboard/DashboardTokenProvider.cs

@@ -0,0 +1,37 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Text;
+using Aspire.Hosting.Utils;
+using Microsoft.Extensions.Options;
+
+namespace Aspire.Hosting.Dashboard;
+
+internal interface IDashboardTokenProvider
+{
+    public string BrowserToken { get; }
+    public string OltpToken { get; }
+    public string ResourceServerToken { get; }
+}
+
+internal class DashboardTokenProvider : IDashboardTokenProvider
+{
+    public DashboardTokenProvider(IOptions<DashboardAuthenticationOptions> dashboardAuthenticationOptions)
+    {
+        BrowserToken = dashboardAuthenticationOptions.Value.BrowserToken ?? GenerateToken();
+        OltpToken = GenerateToken();
+        ResourceServerToken = GenerateToken();
+    }
+
+    private static string GenerateToken()
+    {
+        var rawToken = PasswordGenerator.Generate(24, true, true, true, true, 0, 0, 0, 0);
+        var rawTokenBytes = Encoding.UTF8.GetBytes(rawToken);
+        var encodedToken = Convert.ToHexString(rawTokenBytes).ToLower();
+        return encodedToken;
+    }
+
+    public string BrowserToken { get; }
+    public string OltpToken { get; }
+    public string ResourceServerToken { get; }
+}

src/Aspire.Hosting/Dcp/ApplicationExecutor.cs

@@ -69,7 +69,10 @@ internal sealed class ApplicationExecutor(ILogger<ApplicationExecutor> logger,
                                           DistributedApplicationExecutionContext executionContext,
                                           ResourceNotificationService notificationService,
                                           ResourceLoggerService loggerService,
-                                          IDcpDependencyCheckService dcpDependencyCheckService)
+                                          IDcpDependencyCheckService dcpDependencyCheckService,
+                                          IOptions<DashboardAuthenticationOptions> dashboardAuthenticationOptions,
+                                          IDashboardTokenProvider dashboardTokenProvider
+                                          )
 {
     private const string DebugSessionPortVar = "DEBUG_SESSION_PORT";
 
@@ -708,6 +711,19 @@ private void ConfigureAspireDashboardResource(IResource dashboardResource)
 
             var grpcEndpointUrl = await _dashboardEndpointProvider.GetResourceServiceUriAsync(context.CancellationToken).ConfigureAwait(false);
 
+            if (dashboardAuthenticationOptions.Value.AllowUnsecureTransport.GetValueOrDefault(false))
+            {
+                // Configure for insecure running.
+                context.EnvironmentVariables["DISABLEAUTHPLACEHOLDER"] = true;
+            }
+            else
+            {
+                // Configure for secure running.
+                context.EnvironmentVariables["BROWSERTOKENPLACEHOLDER"] = dashboardTokenProvider.BrowserToken;
+                context.EnvironmentVariables["OTLPTOKENPLACEHOLDER"] = dashboardTokenProvider.OltpToken;
+                context.EnvironmentVariables["RESOURCESERVERTOKENPLACEHOLDER"] = dashboardTokenProvider.ResourceServerToken;
+            }
+
             context.EnvironmentVariables["ASPNETCORE_URLS"] = appHostApplicationUrl;
             context.EnvironmentVariables["DOTNET_RESOURCE_SERVICE_ENDPOINT_URL"] = grpcEndpointUrl;
             context.EnvironmentVariables["DOTNET_DASHBOARD_OTLP_ENDPOINT_URL"] = otlpEndpointUrl;

src/Aspire.Hosting/DistributedApplicationBuilder.cs

@@ -10,8 +10,10 @@
 using Aspire.Hosting.Publishing;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection.Extensions;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
 
 namespace Aspire.Hosting;
 
@@ -89,9 +91,12 @@ public DistributedApplicationBuilder(DistributedApplicationOptions options)
         _innerBuilder.Services.AddSingleton<ResourceLoggerService>();
 
         // Dashboard
+        _innerBuilder.Services.AddOptions<DashboardAuthenticationOptions>().Bind(Configuration.GetSection("Aspire:Dashboard:Authentication"));
+        _innerBuilder.Services.TryAddEnumerable(ServiceDescriptor.Singleton<IValidateOptions<DashboardAuthenticationOptions>, DashboardAuthenticationOptionsValidator>());
         _innerBuilder.Services.AddSingleton<DashboardServiceHost>();
         _innerBuilder.Services.AddHostedService<DashboardServiceHost>(sp => sp.GetRequiredService<DashboardServiceHost>());
         _innerBuilder.Services.AddLifecycleHook<DashboardManifestExclusionHook>();
+        _innerBuilder.Services.AddSingleton<IDashboardTokenProvider, DashboardTokenProvider>();
 
         // DCP stuff
         _innerBuilder.Services.AddSingleton<ApplicationExecutor>();

src/Shared/KnownEnvironmentVariables.cs

@@ -0,0 +1,9 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+namespace Aspire.Hosting;
+
+internal static class KnownEnvironmentVariables
+{
+    public static string AspNetCoreUrls = "ASPNETCORE_URLS";
+}