From 8785f82f5f608f5cec743371726e3389d61cee26 Mon Sep 17 00:00:00 2001 From: Kirill Kovalev Date: Fri, 16 Oct 2026 12:32:53 +0500 Subject: [PATCH] Hide the identity server's home page outside development, as upstream does Upstream's home page, which links to the discovery document and the key set, renders only in the Development environment and answers 404 everywhere else. The migration's home controller rendered it in every environment. It now checks the environment and logs the refusal the way upstream does. --- src/Identity.API/Controllers/HomeController.cs | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/src/Identity.API/Controllers/HomeController.cs b/src/Identity.API/Controllers/HomeController.cs index c9cd6bc3e..e7e536b4d 100644 --- a/src/Identity.API/Controllers/HomeController.cs +++ b/src/Identity.API/Controllers/HomeController.cs @@ -4,8 +4,18 @@ namespace eShop.Identity.API.Controllers { [SecurityHeaders] [AllowAnonymous] - public class HomeController : Controller + public class HomeController(IWebHostEnvironment environment, ILogger logger) : Controller { - public IActionResult Index() => View(); + public IActionResult Index() + { + if (environment.IsDevelopment()) + { + // only show in development + return View(); + } + + logger.LogInformation("Homepage is disabled in production. Returning 404."); + return NotFound(); + } } }