Security

The dashboard shows logs, traces, and metrics — which routinely carry sensitive data (request bodies, stack traces, connection strings inside exception messages). By default, UseNafasDashboard only serves requests that come from the local machine — the same default posture as Hangfire's own dashboard. Every other request gets a 403.

builder.Services.AddNafasServer(options =>
{
    // Runs after your own auth middleware, if you have one registered
    // earlier in the pipeline -- httpContext.User is already populated.
    options.Authorize = httpContext => httpContext.User.IsInRole("Admin");

    // Or, deliberately, open to everyone (not recommended without your
    // own auth in front of it):
    // options.Authorize = _ => true;
});

If you don't set Authorize and the dashboard doesn't load from where you expect (a phone on the same network, a teammate's machine, behind a reverse proxy), this is why — set it explicitly once you know who should be allowed in.