Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions SharedSignalsSample/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@ Silence in both logs after 30 seconds means the sweep found nothing to deliver:

The transmitter logs this before it is asked to do anything, and it does not describe a problem in this sample. It is worth reading once, because telling an inapplicable warning from a real one is the skill this sample is for.

- `2011`, no scope is checked on the Stream Management API. That API is not mapped here at all, so there is no unguarded surface. In 2.4 the warning is raised where the transmitter advertises itself rather than where the management routes are mapped.
- `2011`, no scope is checked on the Stream Management API. That API is not mapped here at all, so there is no unguarded surface. The warning is raised where the transmitter advertises itself rather than where the management routes are mapped.

### Running them both from one terminal

Expand Down Expand Up @@ -149,7 +149,7 @@ That refusal is the one that stops a genuine event addressed to somebody else. T

The Stream Management API is not mapped. This transmitter's streams come from its configuration file, so nothing needs to create one over HTTP. That API is also the surface that has to be guarded by scope, since whoever can create a stream can ask to be told about your users. `MapSharedSignalsTransmitterEndpoints()` maps it together with the configuration document; the sample maps only the document.

The document it does map advertises those management endpoints regardless, because in 2.4 it is built from the route prefix rather than from what was mapped. So a receiver that reads it finds addresses for creating a stream, reading its status, adding and removing subjects and requesting verification, and every one of them answers 404 here. Two other members of that document would say untrue things as well, and those the library does let a host correct: `AuthorizationSchemes = []` stops it advertising OAuth, which would otherwise announce a guarded management surface on a host that authenticates nobody, and `DefaultSubjectsMode` publishes what a created stream would cover. Both are set in `Program.cs`. The addresses are the part that cannot be corrected in 2.4, and the configuration document is the single artefact of this pair that a stranger parses by machine, so it is worth knowing exactly which of its statements this transmitter stands behind.
The document it does map advertises those management endpoints regardless, because it is built from the route prefix rather than from what was mapped. So a receiver that reads it finds addresses for creating a stream, reading its status, adding and removing subjects and requesting verification, and every one of them answers 404 here. Two other members of that document would say untrue things as well, and those the library does let a host correct: `AuthorizationSchemes = []` stops it advertising OAuth, which would otherwise announce a guarded management surface on a host that authenticates nobody, and `DefaultSubjectsMode` publishes what a created stream would cover. Both are set in `Program.cs`. The addresses are the part that cannot be corrected, and the configuration document is the single artifact of this pair that a stranger parses by machine, so it is worth knowing exactly which of its statements this transmitter stands behind.

Poll delivery is not shown. Push is the harder half to get right, because it is the one where the transmitter makes an outbound request to an address someone else chose.

Expand Down
2 changes: 1 addition & 1 deletion SharedSignalsSample/TransmitterApp/Program.cs
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,7 @@
// has to be guarded by scope, because whoever can create a stream can ask to be told about your users.
// MapSharedSignalsTransmitterEndpoints() maps that API and this document together.
//
// Mapping the document alone is not the clean subset it looks like. In 2.4 the document is built from the
// Mapping the document alone is not the clean subset it looks like. The document is built from the
// route prefix rather than from what was mapped, so it advertises the management addresses regardless: a
// receiver that discovers this transmitter reads addresses for creating a stream, reading its status,
// adding and removing subjects and requesting verification, and every one of them answers 404 here.
Expand Down