Skip to content

Harden sample authentication and storage access - #60

Open
abaranwal-ms wants to merge 3 commits into
Azure-Samples:masterfrom
abaranwal-ms:fix/sample-security-hardening
Open

Harden sample authentication and storage access#60
abaranwal-ms wants to merge 3 commits into
Azure-Samples:masterfrom
abaranwal-ms:fix/sample-security-hardening

Conversation

@abaranwal-ms

Copy link
Copy Markdown

Summary

  • remove the .NET sample's global TLS certificate validation bypass
  • keep the Python sample VHD container private and use a short-lived read-only SAS for image creation
  • update the legacy .NET sample Newtonsoft.Json references so the sample restores and builds cleanly

Validation

  • dotnet build dotnetSamples/LocalArm/CreateVmSample/CreateVmSample.sln
  • python -m py_compile Scripts/PythonScript/example_ase.py

Notes

  • the .NET sample executable still requires real Azure Stack Edge configuration values for end-to-end runtime testing
  • the Python sample still requires a live Azure Stack Edge environment and credentials for end-to-end execution

Replace removed TLS bypass with an opt-in thumbprint-pinned validation for the ASE login/management hosts, harden request-host extraction (HttpWebRequest/HttpRequestMessage/string), and add an MSTest project covering the pinning decisions.
Explains what the LocalArm and Python samples do, the certificate-pinning behavior, and the storage SAS change, with diagrams.
@sipastak

sipastak commented Aug 7, 2026

Copy link
Copy Markdown

#sign-off

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants