Joseph Doherty
48 lines
2.2 KiB
C#
48 lines
2.2 KiB
C#
namespace ZB.MOM.WW.ScadaBridge.Security;
|
|
|
|
/// <summary>
|
|
/// Non-LDAP security configuration: the cookie-embedded JWT signing/lifetime
|
|
/// settings and the session idle-timeout / cookie-security policy.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// Task 1.2/1.4 cutover: the LDAP connection settings that used to live here as
|
|
/// flat <c>Ldap*</c> keys (server, port, transport, search base, service account,
|
|
/// attributes, timeout) moved into a nested <c>ScadaBridge:Security:Ldap</c>
|
|
/// sub-section bound to the shared <c>ZB.MOM.WW.Auth.Abstractions.Ldap.LdapOptions</c>
|
|
/// and registered via <c>AddZbLdapAuth</c>. This is a BREAKING config-key change —
|
|
/// see CHANGELOG. The non-LDAP fields below are unchanged and still bound from
|
|
/// <c>ScadaBridge:Security</c>.
|
|
/// </remarks>
|
|
public class SecurityOptions
|
|
{
|
|
/// <summary>
|
|
/// Symmetric HMAC-SHA256 signing key for cookie-embedded JWTs. Must be at least
|
|
/// 32 bytes (256 bits) — validated at <see cref="JwtTokenService"/> construction.
|
|
/// </summary>
|
|
public string JwtSigningKey { get; set; } = string.Empty;
|
|
|
|
/// <summary>
|
|
/// Minimum signing-key length in bytes required for HMAC-SHA256 (256 bits).
|
|
/// </summary>
|
|
public const int MinJwtSigningKeyBytes = 32;
|
|
/// <summary>Cookie-embedded JWT lifetime in minutes before it must be refreshed.</summary>
|
|
public int JwtExpiryMinutes { get; set; } = 15;
|
|
/// <summary>Session idle timeout in minutes; sessions inactive beyond this are expired.</summary>
|
|
public int IdleTimeoutMinutes { get; set; } = 30;
|
|
|
|
/// <summary>
|
|
/// Minutes before token expiry to trigger refresh.
|
|
/// </summary>
|
|
public int JwtRefreshThresholdMinutes { get; set; } = 5;
|
|
|
|
/// <summary>
|
|
/// When true (default) the authentication cookie is always marked
|
|
/// <c>Secure</c> (sent only over HTTPS) — the correct production setting,
|
|
/// since the cookie carries the embedded JWT bearer credential. Set false
|
|
/// for an HTTP-only deployment such as the local Docker dev cluster: the
|
|
/// cookie then uses <c>SameAsRequest</c>, so it is still <c>Secure</c> on
|
|
/// any HTTPS request but is usable over plain HTTP.
|
|
/// </summary>
|
|
public bool RequireHttpsCookie { get; set; } = true;
|
|
}
|