Customize the application-configuration endpoint [Security] #9877

8 Answer(s)

• 

  0

  AI-Bot created 4 hours ago

  Support Team ABP Agent

  To customize or secure the api/abp/application-configuration endpoint in ABP Framework, here are the key points:

  • The application-configuration endpoint is intentionally public by default, as it provides essential configuration data (like localization, settings, multi-tenancy info) required for the frontend to initialize and function properly, even before user authentication.
  • Some sensitive settings (e.g., password policy, lockout policy, etc.) are included for the frontend to enforce or display relevant UI/UX, but you may want to restrict or hide them for security reasons.

  How to Secure or Customize the Endpoint

  1. Override the Controller or AppService:

     • You can override the AbpApplicationConfigurationController or the underlying AbpApplicationConfigurationAppService to filter out or secure specific data.
     • Add the [Authorize] attribute to require authentication, or selectively remove properties from the response.

     Example (override controller and add authorization):

  [Authorize] // Require authentication
     public class MyApplicationConfigurationController : AbpApplicationConfigurationController
     {
         public MyApplicationConfigurationController(
             IAbpApplicationConfigurationAppService appService
         ) : base(appService)
         {
         }
  
         // Optionally override methods to filter response data
     }
  

  2. Potential Impact:

     • Securing this endpoint (making it require authentication) or removing certain data may break the frontend, especially if your UI expects this data before login (e.g., for language selection, UI features, or login policies).
     • If you remove or restrict data, you must also update your frontend to handle missing configuration gracefully.

  3. Best Practice:

     • If you only want to hide specific settings, override the service and filter out sensitive properties from the response, rather than securing the whole endpoint.
     • If you secure the endpoint, ensure your frontend is updated to authenticate before calling it, or to handle missing data.

  References and Further Reading

  • Extending the Application Configuration Endpoint (Community Guide)
  • Customizing Application Modules & Overriding Services (Official Docs)
  • Application Configuration Endpoint (Official Docs)

  This approach is supported by ABP's extensibility model, but you must carefully test your frontend to avoid breaking user experience.

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Save Cancel
• 

  0

  maliming created 4 hours ago

  Support Team Fullstack Developer

  hi

  Both MVC and Angular need to make anonymous/authentication requests to this API. The content it returns is all public, and doesn't contain any secrets.

  Thanks.

  Save Cancel
• 

  0

  NH-Support created 4 hours ago

  I'm not saying it's revealing secret and it doesn't have to reveal a secret to become a "Security Issue"

  I'm saying this increase the attack surface on the application

  is there a way to minimize that exposure ? an anonymous doesn't need to know my lockout policy nor my password policy and what it looks like

  Save Cancel
• 

  0

  maliming created 4 hours ago

  Support Team Fullstack Developer

  hi

  What is your solution structure? Can you share a screenshot?

  UI type: ? Tiered: ?

  Thanks.

  Save Cancel
• 

  0

  NH-Support created 3 hours ago

  ABP Framework v 9.0.1 Angular Tiered Separated Auth

  Also We have a Microservice project with angular app

  Save Cancel
• 

  0

  maliming created 2 hours ago

  Support Team Fullstack Developer

  hi

  Angular needs to call this API endpoint to initialize when the user is not logged in. You can't remove it.

  https://abp.io/docs/latest/framework/api-development/standard-apis/configuration

  This is by design.

  Thanks.

  Save Cancel
• 

  0

  NH-Support created an hour ago

  [maliming] said: hi

  Angular needs to call this API endpoint to initialize when the user is not logged in. You can't remove it.

  https://abp.io/docs/latest/framework/api-development/standard-apis/configuration

  This is by design.

  Thanks.

  the link you shared contains a way to extend the endpoint and append more data again we are not trying to remove it we need to reduce some of the data in the response

  how and where to override this ?

  Save Cancel
• 

  0

  maliming created an hour ago

  Support Team Fullstack Developer

  hi

  we need to reduce some of the data in the response

  You can replace the IAbpApplicationConfigurationAppService to reduce data from DTO if the current user is anonymous.

  https://github.com/abpframework/abp/blob/dev/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/ApplicationConfigurations/AbpApplicationConfigurationAppService.cs#L27

  Thanks.

  Save Cancel