Handcrafted, AI-free blog posts about DevOps, DevSecOps, application security, web development, Azure and similar topics
An application’s pentest revealed weak SSL/TLS cipher suites in Azure App Services. To enhance security, non-forward-secrecy cipher suites must be disabled. Utilizing Terraform and the azapi provider, a workaround was implemented to configure the Minimum TLS Cipher Suite, enforcing modern cryptographic standards.
This post discusses restarting an Azure App Service in an Azure DevOps YAML pipeline after applying IaC config to update Azure Key Vault secrets during deployments.
Last week I struggled (again) running ASP.NET Core integration tests for an ASP.NET Core Web API that uses DefaultAzureCredential in a Azure DevOps YAML pipeline. To avoid having to struggle again, I am writing down my findings here. The initial situation There was an existing ASP.NET Core (.NET 8) Web API project that uses DefaultAzureCredential... Continue Reading →
This week, I faced challenges deploying an ASP.NET Core Web API to an Azure App Service using GitHub Actions and OpenID Connect. Initial attempts with azure/webapps-deploy@v3 failed due to missing credentials. A later try with azure/cli@v2 failed because the deployment file wasn't a valid zip. Properly zipping the files led to successful deployment.
The blog post details the process of rotating secrets stored in Azure Key Vault with each application deployment, utilizing Infrastructure as Code (IaC) principles via Terraform. It emphasizes the importance of secret rotation to minimize risks from leaks. An ASP.NET Core Web API is demonstrated as the application example, alongside procedural GitHub Actions for deployment.
The Azure DevOps YAML pipeline encountered an error requiring 'az login' during a Terraform task due to a local-exec provisioner executing a PowerShell script that needed Azure CLI access. Despite this error, the pipeline completed successfully. Activating runAzLogin resolved the issue, enabling the script's changes to be applied effectively.
In spring 2024, I developed offline capabilities for a Blazor Progressive Web App consisting of a .NET Web API and Blazor WASM client. This involved storing form data in local storage when offline and syncing the data when online again. The solution uses service worker to cache necessary assets, ensuring users could access forms without an internet connection.
Recently an error occurred in an Azure DevOps build pipeline due to a conflict with a non-running Docker container, impacting integration tests using Testcontainers.MsSql. A workaround was suggested to resolve compatibility issues on Linux by updating the Docker image used by Testcontainers.MsSql.
This blog post discusses the integration of SonarCloud code coverage reporting in an Azure DevOps YAML pipeline for .NET projects. It highlights adjustments needed when running such a pipeline on Azure DevOps Microsoft-hosted linux agents.
When upgrading from Microsoft Graph .NET Client Library v4 to v5, adapting GraphServiceClient methods for team channel notification subscriptions according to official documentation caused issues. Despite the recommended code changes, they did not work as expected. After extensive debugging and research, a workaround was found to resolve the issue. This is a known issue with POST requests in v5.
