[{"data":1,"prerenderedAt":197},["ShallowReactive",2],{"docs-\u002Fdocs\u002Fconfiguration\u002Fsecurity":3,"docs-navigation":122},{"id":4,"title":5,"body":6,"description":115,"extension":116,"meta":117,"navTitle":5,"navigation":76,"path":118,"seo":119,"stem":120,"__hash__":121},"docs\u002Fdocs\u002F3.configuration\u002F2.security.md","Security",{"type":7,"value":8,"toc":113},"minimark",[9,30,102,109],[10,11,12,13,17,18,25,26,29],"p",{},"The dashboard shows logs, traces, and metrics — which routinely carry\nsensitive data (request bodies, stack traces, connection strings inside\nexception messages). By default, ",[14,15,16],"code",{},"UseNafasDashboard"," only serves requests\nthat come from the local machine — the same default posture as\n",[19,20,24],"a",{"href":21,"rel":22},"https:\u002F\u002Fdocs.hangfire.io\u002Fen\u002Flatest\u002Fconfiguration\u002Fusing-dashboard.html#configuring-authorization",[23],"nofollow","Hangfire's own dashboard",".\nEvery other request gets a ",[14,27,28],{},"403",".",[31,32,37],"pre",{"className":33,"code":34,"language":35,"meta":36,"style":36},"language-csharp shiki shiki-themes github-light github-dark","builder.Services.AddNafasServer(options =>\n{\n    \u002F\u002F Runs after your own auth middleware, if you have one registered\n    \u002F\u002F earlier in the pipeline -- httpContext.User is already populated.\n    options.Authorize = httpContext => httpContext.User.IsInRole(\"Admin\");\n\n    \u002F\u002F Or, deliberately, open to everyone (not recommended without your\n    \u002F\u002F own auth in front of it):\n    \u002F\u002F options.Authorize = _ => true;\n});\n","csharp","",[14,38,39,47,53,59,65,71,78,84,90,96],{"__ignoreMap":36},[40,41,44],"span",{"class":42,"line":43},"line",1,[40,45,46],{},"builder.Services.AddNafasServer(options =>\n",[40,48,50],{"class":42,"line":49},2,[40,51,52],{},"{\n",[40,54,56],{"class":42,"line":55},3,[40,57,58],{},"    \u002F\u002F Runs after your own auth middleware, if you have one registered\n",[40,60,62],{"class":42,"line":61},4,[40,63,64],{},"    \u002F\u002F earlier in the pipeline -- httpContext.User is already populated.\n",[40,66,68],{"class":42,"line":67},5,[40,69,70],{},"    options.Authorize = httpContext => httpContext.User.IsInRole(\"Admin\");\n",[40,72,74],{"class":42,"line":73},6,[40,75,77],{"emptyLinePlaceholder":76},true,"\n",[40,79,81],{"class":42,"line":80},7,[40,82,83],{},"    \u002F\u002F Or, deliberately, open to everyone (not recommended without your\n",[40,85,87],{"class":42,"line":86},8,[40,88,89],{},"    \u002F\u002F own auth in front of it):\n",[40,91,93],{"class":42,"line":92},9,[40,94,95],{},"    \u002F\u002F options.Authorize = _ => true;\n",[40,97,99],{"class":42,"line":98},10,[40,100,101],{},"});\n",[10,103,104,105,108],{},"If you don't set ",[14,106,107],{},"Authorize"," and the dashboard doesn't load from where you\nexpect (a phone on the same network, a teammate's machine, behind a\nreverse proxy), this is why — set it explicitly once you know who should\nbe allowed in.",[110,111,112],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":36,"searchDepth":49,"depth":49,"links":114},[],"The dashboard is local-requests-only by default — the same posture as Hangfire's own dashboard.","md",{},"\u002Fdocs\u002Fconfiguration\u002Fsecurity",{"title":5,"description":115},"docs\u002F3.configuration\u002F2.security","mxca3BtCg-wewtlK7kY5Je6vrC0Dg1yYnueFJg0tJ6E",[123],{"title":124,"path":125,"stem":126,"children":127},"Docs","\u002Fdocs","docs",[128,131,149,162,172,185,193],{"title":129,"path":125,"stem":130},"Documentation","docs\u002Findex",{"title":132,"path":133,"stem":134,"children":135,"page":148},"Getting Started","\u002Fdocs\u002Fgetting-started","docs\u002F1.getting-started",[136,140,144],{"title":137,"path":138,"stem":139},"Why Nafas","\u002Fdocs\u002Fgetting-started\u002Fwhy-nafas","docs\u002F1.getting-started\u002F1.why-nafas",{"title":141,"path":142,"stem":143},"Quick start","\u002Fdocs\u002Fgetting-started\u002Fquick-start","docs\u002F1.getting-started\u002F2.quick-start",{"title":145,"path":146,"stem":147},"Requirements","\u002Fdocs\u002Fgetting-started\u002Frequirements","docs\u002F1.getting-started\u002F3.requirements",false,{"title":150,"path":151,"stem":152,"children":153,"page":148},"How It Works","\u002Fdocs\u002Fhow-it-works","docs\u002F2.how-it-works",[154,158],{"title":155,"path":156,"stem":157},"What gets captured, and how","\u002Fdocs\u002Fhow-it-works\u002Fwhat-gets-captured","docs\u002F2.how-it-works\u002F1.what-gets-captured",{"title":159,"path":160,"stem":161},"How it's built internally","\u002Fdocs\u002Fhow-it-works\u002Finternals","docs\u002F2.how-it-works\u002F2.internals",{"title":163,"path":164,"stem":165,"children":166,"page":148},"Configuration","\u002Fdocs\u002Fconfiguration","docs\u002F3.configuration",[167,171],{"title":168,"path":169,"stem":170},"Configuration options","\u002Fdocs\u002Fconfiguration\u002Foptions","docs\u002F3.configuration\u002F1.options",{"title":5,"path":118,"stem":120},{"title":173,"path":174,"stem":175,"children":176,"page":148},"Deployment","\u002Fdocs\u002Fdeployment","docs\u002F4.deployment",[177,181],{"title":178,"path":179,"stem":180},"Multi-instance deployments","\u002Fdocs\u002Fdeployment\u002Fmulti-instance","docs\u002F4.deployment\u002F1.multi-instance",{"title":182,"path":183,"stem":184},"Desktop and other non-ASP.NET Core apps","\u002Fdocs\u002Fdeployment\u002Fdesktop-apps","docs\u002F4.deployment\u002F2.desktop-apps",{"title":186,"path":187,"stem":188,"children":189,"page":148},"Alerting","\u002Fdocs\u002Falerting","docs\u002F5.alerting",[190],{"title":186,"path":191,"stem":192},"\u002Fdocs\u002Falerting\u002Falert-rules","docs\u002F5.alerting\u002F1.alert-rules",{"title":194,"path":195,"stem":196},"Contributing","\u002Fdocs\u002Fcontributing","docs\u002F6.contributing",1789838144292]