You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Add browser-facing origin references for CORS and redirect configuration - #21260
Browser-facing URLs such as *.dev.localhost currently exist only as dashboard display URLs. AppHosts cannot reference those addresses when configuring CORS or authentication redirects, so configuration can disagree with the origin the browser actually uses.
Expose finalized browser origins as ordinary endpoint-reference properties, without changing host or container service discovery:
URL customization completes before endpoint-allocation observers run. Origins omit credentials, navigation paths, queries, and fragments, and duplicate origins are removed. Entra redirect helpers share the finalized local origin; publication retains their existing compute-environment hostname and HTTPS convention.
Local display URLs are not deployment addresses. Native publishers interpret the endpoint property using their existing publication paths:
Container Apps and App Service use public platform addresses where available, otherwise configurable inputs.
Compose uses configurable inputs defaulting to localhost and the explicit published port for external HTTP endpoints. Unknown published ports require inputs.
Kubernetes, including AKS-backed publishing, derives defaults from explicit literal Ingress/Gateway routing hosts and matching TLS configuration. Hostless, wildcard, and deferred hostname sources require inputs rather than substituting service DNS.
Foundry exposes the authority of its deployed project endpoint. Sandboxes resolves the authority from the deployed proxy URL, after the producer is deployed. Radius workload configuration requires deployment inputs rather than using cluster-local DNS.
The manifest publisher lowers the three new origin properties to required inputs, including within selected conditional branches, formatted expressions, and resource manifest callbacks. Recognized endpoint tokens remain symbolic for azd. Generalizing existing handling of other unsupported endpoint properties, changing published TLS policy, and adding publish-time origin customization are outside this change.
WithUrls and WithUrlForEndpoint callbacks now finish before ResourceEndpointsAllocatedEvent handlers run. Code that registers URL customization from those handlers must move registration into model configuration. Physical endpoint allocation and host/container service discovery remain unchanged.
Security considerations
Origins can feed CORS allowlists and authentication redirect configuration. URL customization remains application-controlled; local vanity URLs are not silently reused as published addresses. No new listeners or authorization mechanisms are introduced.
Validation
Validation covers the current local revision; these code updates have not yet been committed or pushed. No live Azure/Entra, Kubernetes, or Radius deployments, or local E2E suites, were run.
Exact local commands and results
Core endpoint, manifest, and parameter coverage — passed, 191 tests:
Finalize customized browser URLs before endpoint allocation observers, expose deferred origin and URL projections, and use them for Entra redirects. Lower manifest values through existing schema features while preserving selected-path evaluation and symbolic deployment references.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b3d226ee-2c7f-4986-a0e4-a6d27b72f6ec
Eric Erhardt (@eerhardt) I did a thing based on our discussion of how the browser URLs would need to work to be general purpose. This basically takes the work you did but makes it generalized and removes the callback order risk.
Lower complete structured expressions before token matching and reject ambiguous provider matches. Retain formatting alias metadata so nested URI encoding preserves each pass without resolving deployment parameters.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b3d226ee-2c7f-4986-a0e4-a6d27b72f6ec
The new sandbox-origin test pre-populates Ports, so it verifies URI extraction but not that a browser-origin reference is resolved after its producer deploys and reaches the consuming workload. No deployment E2E currently consumes BrowserOrigins. Please extend tests/Aspire.Deployment.EndToEnd.Tests/AzureSandboxesDeploymentTests.cs with a producer/consumer scenario that injects these properties and compares the consumer's received values with the producer's actual deployed proxy authority; this would catch deployment-order and value-projection failures that the seeded-state test cannot detect.
Preserve the Azure environment test imports and upstream experimental API suppression. Update the browser-origin Entra snapshot for the upstream service-principal tags.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b3d226ee-2c7f-4986-a0e4-a6d27b72f6ec
Preserve shared URL contracts and regenerate the Go SDK snapshot. Adapt browser-origin tests and the Entra redirect overload to upstream deprecation and explicit-export requirements.
Validation: 247 targeted checks passed across hosting, five code generators, Azure, Docker, Kubernetes, and Entra; deployment tests compile. DotnetProject V2 URL validation remains incomplete after a child MSBuild task-host failure and a bounded test timeout.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b3d226ee-2c7f-4986-a0e4-a6d27b72f6ec
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
Secret-containing environment expressions still produce invalid YAML because ToSecret does not correctly quote evaluated values, preventing Helm chart installation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
area-app-modelIssues pertaining to the APIs in Aspire.Hosting, e.g. DistributedApplicationbreaking-changeIssue or PR that represents a breaking API or functional change over a prerelease.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
David Negstad (danegsta)
added
the
breaking-change
github-actions
Bot
added
the
area-app-model
Description
Browser-facing URLs such as
*.dev.localhostcurrently exist only as dashboard display URLs. AppHosts cannot reference those addresses when configuring CORS or authentication redirects, so configuration can disagree with the origin the browser actually uses.Expose finalized browser origins as ordinary endpoint-reference properties, without changing host or container service discovery:
URL customization completes before endpoint-allocation observers run. Origins omit credentials, navigation paths, queries, and fragments, and duplicate origins are removed. Entra redirect helpers share the finalized local origin; publication retains their existing compute-environment hostname and HTTPS convention.
Local display URLs are not deployment addresses. Native publishers interpret the endpoint property using their existing publication paths:
The manifest publisher lowers the three new origin properties to required inputs, including within selected conditional branches, formatted expressions, and resource manifest callbacks. Recognized endpoint tokens remain symbolic for azd. Generalizing existing handling of other unsupported endpoint properties, changing published TLS policy, and adding publish-time origin customization are outside this change.
Fixes #18819
Compatibility
WithUrlsandWithUrlForEndpointcallbacks now finish beforeResourceEndpointsAllocatedEventhandlers run. Code that registers URL customization from those handlers must move registration into model configuration. Physical endpoint allocation and host/container service discovery remain unchanged.Security considerations
Origins can feed CORS allowlists and authentication redirect configuration. URL customization remains application-controlled; local vanity URLs are not silently reused as published addresses. No new listeners or authorization mechanisms are introduced.
Validation
Validation covers the current local revision; these code updates have not yet been committed or pushed. No live Azure/Entra, Kubernetes, or Radius deployments, or local E2E suites, were run.
Exact local commands and results
Core endpoint, manifest, and parameter coverage — passed, 191 tests:
Compose inputs, defaults, and preparation — passed, 13 tests:
Kubernetes routing defaults and input overrides — passed, 20 tests:
Foundry unit suite — passed, 201 tests:
Radius deployment bindings and existing endpoint/value resolution — passed, 91 tests:
Azure workload and sandbox origins — passed, 11 tests:
Entra redirect helpers — passed, 20 tests:
The explicit origin overload was also re-run with concrete published callback-value assertions — passed, 1 test:
Checklist
<remarks />and<code />elements on your triple slash comments?