fix monikers /3 (#28870)
* fix monikers /3 * fix monikers /3 * fix monikers /3 * fix monikers /3pull/28855/head
Rick Anderson
GitHub
parent
219a659951
commit
2de70adad6
|
|
@ -40,135 +40,6 @@ Specify the value used to track if the user consented to the cookie use policy u
|
|||
|
||||
[!code-csharp[Main](~/security/gdpr/sample/RP6.0/WebGDPR/Program.cs?name=snippet_2&highlight=8)]
|
||||
|
||||
:::moniker-end
|
||||
|
||||
:::moniker range="= aspnetcore-6.0"
|
||||
|
||||
* The project templates include extension points and stubbed markup that you can replace with your privacy and cookie use policy.
|
||||
* The `Pages/Privacy.cshtml` page or `Views/Home/Privacy.cshtml` view provides a page to detail your site's privacy policy.
|
||||
|
||||
To enable the default cookie consent feature like that found in the ASP.NET Core 2.2 templates in a current ASP.NET Core template generated app, add the following highlighted code to `Program.cs`:
|
||||
|
||||
[!code-csharp[Main](~/security/gdpr/sample/RP6.0/WebGDPR/Program.cs?name=snippet_1&highlight=4-11,23)]
|
||||
|
||||
In the preceding code, <xref:Microsoft.AspNetCore.Builder.CookiePolicyOptions> and <xref:Microsoft.AspNetCore.Builder.CookiePolicyAppBuilderExtensions.UseCookiePolicy%2A> are used.
|
||||
|
||||
* Add the cookie consent partial to the `_Layout.cshtml` file:
|
||||
|
||||
[!code-cshtml[Main](~/security/gdpr/sample/RP6.0/WebGDPR/Pages/Shared/_Layout.cshtml?name=snippet&highlight=4)]
|
||||
|
||||
* Add the `_CookieConsentPartial.cshtml` file to the project:
|
||||
|
||||
[!code-cshtml[Main](~/security/gdpr/sample/RP6.0/WebGDPR/Pages/Shared/_CookieConsentPartial.cshtml)]
|
||||
|
||||
* Select the ASP.NET Core [2.2 version](xref:security/gdpr?view=aspnetcore-2.2&preserve-view=true) of this article to read about the cookie consent feature.
|
||||
|
||||
:::moniker-end
|
||||
|
||||
:::moniker range=">= aspnetcore-3.0 < aspnetcore-6.0"
|
||||
|
||||
* The project templates include extension points and stubbed markup that you can replace with your privacy and cookie use policy.
|
||||
* The `Pages/Privacy.cshtml` page or `Views/Home/Privacy.cshtml` view provides a page to detail your site's privacy policy.
|
||||
|
||||
To enable the default cookie consent feature like that found in the ASP.NET Core 2.2 templates in a current ASP.NET Core template generated app:
|
||||
|
||||
* Add `using Microsoft.AspNetCore.Http` to the list of using directives.
|
||||
* Add <xref:Microsoft.AspNetCore.Builder.CookiePolicyOptions> to `Startup.ConfigureServices` and <xref:Microsoft.AspNetCore.Builder.CookiePolicyAppBuilderExtensions.UseCookiePolicy%2A> to `Startup.Configure`:
|
||||
|
||||
[!code-csharp[Main](gdpr/sample/RP3.0/Startup.cs?name=snippet1&highlight=12-19,38)]
|
||||
|
||||
* Add the cookie consent partial to the `_Layout.cshtml` file:
|
||||
|
||||
[!code-cshtml[Main](gdpr/sample/RP3.0/Pages/Shared/_Layout.cshtml?name=snippet&highlight=4)]
|
||||
|
||||
* Add the *\_CookieConsentPartial.cshtml* file to the project:
|
||||
|
||||
[!code-cshtml[Main](gdpr/sample/RP3.0/Pages/Shared/_CookieConsentPartial.cshtml)]
|
||||
|
||||
* Select the ASP.NET Core 2.2 version of this article to read about the cookie consent feature.
|
||||
|
||||
:::moniker-end
|
||||
|
||||
:::moniker range="= aspnetcore-2.2"
|
||||
|
||||
* The project templates include extension points and stubbed markup that you can replace with your privacy and cookie use policy.
|
||||
* A cookie consent feature allows you to ask for (and track) consent from your users for storing personal information. If a user hasn't consented to data collection and the app has <xref:Microsoft.AspNetCore.Builder.CookiePolicyOptions.CheckConsentNeeded%2A> set to `true`, non-essential cookies aren't sent to the browser.
|
||||
* Cookies can be marked as essential. Essential cookies are sent to the browser even when the user hasn't consented and tracking is disabled.
|
||||
* [TempData and Session cookies](#tempdata) aren't functional when tracking is disabled.
|
||||
* The [Identity manage](#pd) page provides a link to download and delete user data.
|
||||
|
||||
The [sample app](https://github.com/dotnet/AspNetCore.Docs/tree/live/aspnetcore/security/gdpr/sample) allows you to test most of the GDPR extension points and APIs added to the ASP.NET Core 2.1 templates. See the [ReadMe](https://github.com/dotnet/AspNetCore.Docs/tree/live/aspnetcore/security/gdpr/sample) file for testing instructions.
|
||||
|
||||
[View or download sample code](https://github.com/dotnet/AspNetCore.Docs/tree/live/aspnetcore/security/gdpr/sample) ([how to download](xref:index#how-to-download-a-sample))
|
||||
|
||||
## ASP.NET Core GDPR support in template-generated code
|
||||
|
||||
Razor Pages and MVC projects created with the project templates include the following GDPR support:
|
||||
|
||||
* <xref:Microsoft.AspNetCore.Builder.CookiePolicyOptions> and <xref:Microsoft.AspNetCore.Builder.CookiePolicyAppBuilderExtensions.UseCookiePolicy%2A> are set in the `Startup` class.
|
||||
* The *\_CookieConsentPartial.cshtml* [partial view](xref:mvc/views/tag-helpers/builtin-th/partial-tag-helper). An **Accept** button is included in this file. When the user clicks the **Accept** button, consent to store cookies is provided.
|
||||
* The `Pages/Privacy.cshtml` page or `Views/Home/Privacy.cshtml` view provides a page to detail your site's privacy policy. The *\_CookieConsentPartial.cshtml* file generates a link to the Privacy page.
|
||||
* For apps created with individual user accounts, the Manage page provides links to download and delete [personal user data](#pd).
|
||||
|
||||
### CookiePolicyOptions and UseCookiePolicy
|
||||
|
||||
<xref:Microsoft.AspNetCore.Builder.CookiePolicyOptions> are initialized in `Startup.ConfigureServices`:
|
||||
|
||||
[!code-csharp[Main](gdpr/sample/Startup.cs?name=snippet1&highlight=14-20)]
|
||||
|
||||
<xref:Microsoft.AspNetCore.Builder.CookiePolicyAppBuilderExtensions.UseCookiePolicy%2A> is called in `Startup.Configure`:
|
||||
|
||||
[!code-csharp[](gdpr/sample/Startup.cs?name=snippet1&highlight=51)]
|
||||
|
||||
### \_CookieConsentPartial.cshtml partial view
|
||||
|
||||
The *\_CookieConsentPartial.cshtml* partial view:
|
||||
|
||||
[!code-cshtml[](gdpr/sample/RP2.2/Pages/Shared/_CookieConsentPartial.cshtml)]
|
||||
|
||||
This partial:
|
||||
|
||||
* Obtains the state of tracking for the user. If the app is configured to require consent, the user must consent before cookies can be tracked. If consent is required, the cookie consent panel is fixed at top of the navigation bar created by the *\_Layout.cshtml* file.
|
||||
* Provides an HTML `<p>` element to summarize your privacy and cookie use policy.
|
||||
* Provides a link to Privacy page or view where you can detail your site's privacy policy.
|
||||
|
||||
## Essential cookies
|
||||
|
||||
If consent to store cookies hasn't been provided, only cookies marked essential are sent to the browser. The following code makes a cookie essential:
|
||||
|
||||
[!code-csharp[Main](gdpr/sample/RP2.2/Pages/Cookie.cshtml.cs?name=snippet1&highlight=5)]
|
||||
|
||||
<a name="tempdata"></a>
|
||||
|
||||
### TempData provider and session state cookies aren't essential
|
||||
|
||||
The [TempData provider](xref:fundamentals/app-state#tempdata) cookie isn't essential. If tracking is disabled, the TempData provider isn't functional. To enable the TempData provider when tracking is disabled, mark the TempData cookie as essential in `Startup.ConfigureServices`:
|
||||
|
||||
[!code-csharp[Main](gdpr/sample/RP2.2/Startup.cs?name=snippet1)]
|
||||
|
||||
[Session state](xref:fundamentals/app-state) cookies are not essential. Session state isn't functional when tracking is disabled. The following code makes session cookies essential:
|
||||
|
||||
[!code-csharp[](gdpr/sample/RP2.2/Startup.cs?name=snippet2)]
|
||||
|
||||
<a name="pd"></a>
|
||||
|
||||
## Personal data
|
||||
|
||||
ASP.NET Core apps created with individual user accounts include code to download and delete personal data.
|
||||
|
||||
Select the user name and then select **Personal data**:
|
||||
|
||||
|
||||
|
||||
Notes:
|
||||
|
||||
* To generate the `Account/Manage` code, see [Scaffold Identity](xref:security/authentication/scaffold-identity).
|
||||
* The **Delete** and **Download** links only act on the default identity data. Apps that create custom user data must be extended to delete/download the custom user data. For more information, see [Add, download, and delete custom user data to Identity](xref:security/authentication/add-user-data).
|
||||
* Saved tokens for the user that are stored in the Identity database table `AspNetUserTokens` are deleted when the user is deleted via the cascading delete behavior due to the [foreign key](https://github.com/aspnet/Identity/blob/release/2.1/src/EF/IdentityUserContext.cs#L152).
|
||||
* [External provider authentication](xref:security/authentication/social/index), such as Facebook and Google, isn't available before the cookie policy is accepted.
|
||||
|
||||
:::moniker-end
|
||||
|
||||
## Encryption at rest
|
||||
|
||||
Some databases and storage mechanisms allow for encryption at rest. Encryption at rest:
|
||||
|
|
@ -194,3 +65,9 @@ For databases that don't provide built-in encryption at rest, you may be able to
|
|||
## Additional resources
|
||||
|
||||
* [Microsoft.com/GDPR](https://www.microsoft.com/trustcenter/Privacy/GDPR)
|
||||
|
||||
:::moniker-end
|
||||
|
||||
[!INCLUDE[](~//security/gdpr/includes/gdpr2.md)]
|
||||
[!INCLUDE[](~//security/gdpr/includes/gdpr35.md)]
|
||||
[!INCLUDE[](~//security/gdpr/includes/gdpr6.md)]
|
||||
|
|
@ -0,0 +1,104 @@
|
|||
:::moniker range="= aspnetcore-2.2"
|
||||
|
||||
* The project templates include extension points and stubbed markup that you can replace with your privacy and cookie use policy.
|
||||
* A cookie consent feature allows you to ask for (and track) consent from your users for storing personal information. If a user hasn't consented to data collection and the app has <xref:Microsoft.AspNetCore.Builder.CookiePolicyOptions.CheckConsentNeeded%2A> set to `true`, non-essential cookies aren't sent to the browser.
|
||||
* Cookies can be marked as essential. Essential cookies are sent to the browser even when the user hasn't consented and tracking is disabled.
|
||||
* [TempData and Session cookies](#tempdata) aren't functional when tracking is disabled.
|
||||
* The [Identity manage](#pd) page provides a link to download and delete user data.
|
||||
|
||||
The [sample app](https://github.com/dotnet/AspNetCore.Docs/tree/live/aspnetcore/security/gdpr/sample) allows you to test most of the GDPR extension points and APIs added to the ASP.NET Core 2.1 templates. See the [ReadMe](https://github.com/dotnet/AspNetCore.Docs/tree/live/aspnetcore/security/gdpr/sample) file for testing instructions.
|
||||
|
||||
[View or download sample code](https://github.com/dotnet/AspNetCore.Docs/tree/live/aspnetcore/security/gdpr/sample) ([how to download](xref:index#how-to-download-a-sample))
|
||||
|
||||
## ASP.NET Core GDPR support in template-generated code
|
||||
|
||||
Razor Pages and MVC projects created with the project templates include the following GDPR support:
|
||||
|
||||
* <xref:Microsoft.AspNetCore.Builder.CookiePolicyOptions> and <xref:Microsoft.AspNetCore.Builder.CookiePolicyAppBuilderExtensions.UseCookiePolicy%2A> are set in the `Startup` class.
|
||||
* The *\_CookieConsentPartial.cshtml* [partial view](xref:mvc/views/tag-helpers/builtin-th/partial-tag-helper). An **Accept** button is included in this file. When the user clicks the **Accept** button, consent to store cookies is provided.
|
||||
* The `Pages/Privacy.cshtml` page or `Views/Home/Privacy.cshtml` view provides a page to detail your site's privacy policy. The *\_CookieConsentPartial.cshtml* file generates a link to the Privacy page.
|
||||
* For apps created with individual user accounts, the Manage page provides links to download and delete [personal user data](#pd).
|
||||
|
||||
### CookiePolicyOptions and UseCookiePolicy
|
||||
|
||||
<xref:Microsoft.AspNetCore.Builder.CookiePolicyOptions> are initialized in `Startup.ConfigureServices`:
|
||||
|
||||
[!code-csharp[Main](~/security/gdpr/sample/Startup.cs?name=snippet1&highlight=14-20)]
|
||||
|
||||
<xref:Microsoft.AspNetCore.Builder.CookiePolicyAppBuilderExtensions.UseCookiePolicy%2A> is called in `Startup.Configure`:
|
||||
|
||||
[!code-csharp[](~/security/gdpr/sample/Startup.cs?name=snippet1&highlight=51)]
|
||||
|
||||
### \_CookieConsentPartial.cshtml partial view
|
||||
|
||||
The *\_CookieConsentPartial.cshtml* partial view:
|
||||
|
||||
[!code-cshtml[](~/security/gdpr/sample/RP2.2/Pages/Shared/_CookieConsentPartial.cshtml)]
|
||||
|
||||
This partial:
|
||||
|
||||
* Obtains the state of tracking for the user. If the app is configured to require consent, the user must consent before cookies can be tracked. If consent is required, the cookie consent panel is fixed at top of the navigation bar created by the *\_Layout.cshtml* file.
|
||||
* Provides an HTML `<p>` element to summarize your privacy and cookie use policy.
|
||||
* Provides a link to Privacy page or view where you can detail your site's privacy policy.
|
||||
|
||||
## Essential cookies
|
||||
|
||||
If consent to store cookies hasn't been provided, only cookies marked essential are sent to the browser. The following code makes a cookie essential:
|
||||
|
||||
[!code-csharp[Main](~/security/gdpr/sample/RP2.2/Pages/Cookie.cshtml.cs?name=snippet1&highlight=5)]
|
||||
|
||||
<a name="tempdata"></a>
|
||||
|
||||
### TempData provider and session state cookies aren't essential
|
||||
|
||||
The [TempData provider](xref:fundamentals/app-state#tempdata) cookie isn't essential. If tracking is disabled, the TempData provider isn't functional. To enable the TempData provider when tracking is disabled, mark the TempData cookie as essential in `Startup.ConfigureServices`:
|
||||
|
||||
[!code-csharp[Main](~/security/gdpr/sample/RP2.2/Startup.cs?name=snippet1)]
|
||||
|
||||
[Session state](xref:fundamentals/app-state) cookies are not essential. Session state isn't functional when tracking is disabled. The following code makes session cookies essential:
|
||||
|
||||
[!code-csharp[](~/security/gdpr/sample/RP2.2/Startup.cs?name=snippet2)]
|
||||
|
||||
<a name="pd"></a>
|
||||
|
||||
## Personal data
|
||||
|
||||
ASP.NET Core apps created with individual user accounts include code to download and delete personal data.
|
||||
|
||||
Select the user name and then select **Personal data**:
|
||||
|
||||
|
||||
|
||||
Notes:
|
||||
|
||||
* To generate the `Account/Manage` code, see [Scaffold Identity](xref:security/authentication/scaffold-identity).
|
||||
* The **Delete** and **Download** links only act on the default identity data. Apps that create custom user data must be extended to delete/download the custom user data. For more information, see [Add, download, and delete custom user data to Identity](xref:security/authentication/add-user-data).
|
||||
* Saved tokens for the user that are stored in the Identity database table `AspNetUserTokens` are deleted when the user is deleted via the cascading delete behavior due to the [foreign key](https://github.com/aspnet/Identity/blob/release/2.1/src/EF/IdentityUserContext.cs#L152).
|
||||
* [External provider authentication](xref:security/authentication/social/index), such as Facebook and Google, isn't available before the cookie policy is accepted.
|
||||
|
||||
## Encryption at rest
|
||||
|
||||
Some databases and storage mechanisms allow for encryption at rest. Encryption at rest:
|
||||
|
||||
* Encrypts stored data automatically.
|
||||
* Encrypts without configuration, programming, or other work for the software that accesses the data.
|
||||
* Is the easiest and safest option.
|
||||
* Allows the database to manage keys and encryption.
|
||||
|
||||
For example:
|
||||
|
||||
* Microsoft SQL and Azure SQL provide [Transparent Data Encryption](/sql/relational-databases/security/encryption/transparent-data-encryption) (TDE).
|
||||
* [SQL Azure encrypts the database by default](https://azure.microsoft.com/updates/newly-created-azure-sql-databases-encrypted-by-default/)
|
||||
* [Azure Blobs, Files, Table, and Queue Storage are encrypted by default](https://azure.microsoft.com/blog/announcing-default-encryption-for-azure-blobs-files-table-and-queue-storage/).
|
||||
|
||||
For databases that don't provide built-in encryption at rest, you may be able to use disk encryption to provide the same protection. For example:
|
||||
|
||||
* [BitLocker for Windows Server](/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server)
|
||||
* Linux:
|
||||
* [eCryptfs](https://launchpad.net/ecryptfs)
|
||||
* [EncFS](https://github.com/vgough/encfs).
|
||||
|
||||
## Additional resources
|
||||
|
||||
* [Microsoft.com/GDPR](https://www.microsoft.com/trustcenter/Privacy/GDPR)
|
||||
:::moniker-end
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
:::moniker range=">= aspnetcore-3.0 < aspnetcore-6.0"
|
||||
|
||||
* The project templates include extension points and stubbed markup that you can replace with your privacy and cookie use policy.
|
||||
* The `Pages/Privacy.cshtml` page or `Views/Home/Privacy.cshtml` view provides a page to detail your site's privacy policy.
|
||||
|
||||
To enable the default cookie consent feature like that found in the ASP.NET Core 2.2 templates in a current ASP.NET Core template generated app:
|
||||
|
||||
* Add `using Microsoft.AspNetCore.Http` to the list of using directives.
|
||||
* Add <xref:Microsoft.AspNetCore.Builder.CookiePolicyOptions> to `Startup.ConfigureServices` and <xref:Microsoft.AspNetCore.Builder.CookiePolicyAppBuilderExtensions.UseCookiePolicy%2A> to `Startup.Configure`:
|
||||
|
||||
[!code-csharp[Main](~/security/gdpr/sample/RP3.0/Startup.cs?name=snippet1&highlight=12-19,38)]
|
||||
|
||||
* Add the cookie consent partial to the `_Layout.cshtml` file:
|
||||
|
||||
[!code-cshtml[Main](~/security/gdpr/sample/RP3.0/Pages/Shared/_Layout.cshtml?name=snippet&highlight=4)]
|
||||
|
||||
* Add the *\_CookieConsentPartial.cshtml* file to the project:
|
||||
|
||||
[!code-cshtml[Main](~/security/gdpr/sample/RP3.0/Pages/Shared/_CookieConsentPartial.cshtml)]
|
||||
|
||||
* Select the ASP.NET Core 2.2 version of this article to read about the cookie consent feature.
|
||||
|
||||
:::moniker-end
|
||||
|
|
@ -0,0 +1,48 @@
|
|||
:::moniker range="= aspnetcore-6.0"
|
||||
|
||||
* The project templates include extension points and stubbed markup that you can replace with your privacy and cookie use policy.
|
||||
* The `Pages/Privacy.cshtml` page or `Views/Home/Privacy.cshtml` view provides a page to detail your site's privacy policy.
|
||||
|
||||
To enable the default cookie consent feature like that found in the ASP.NET Core 2.2 templates in a current ASP.NET Core template generated app, add the following highlighted code to `Program.cs`:
|
||||
|
||||
[!code-csharp[Main](~/security/gdpr/sample/RP6.0/WebGDPR/Program.cs?name=snippet_1&highlight=4-11,23)]
|
||||
|
||||
In the preceding code, <xref:Microsoft.AspNetCore.Builder.CookiePolicyOptions> and <xref:Microsoft.AspNetCore.Builder.CookiePolicyAppBuilderExtensions.UseCookiePolicy%2A> are used.
|
||||
|
||||
* Add the cookie consent partial to the `_Layout.cshtml` file:
|
||||
|
||||
[!code-cshtml[Main](~/security/gdpr/sample/RP6.0/WebGDPR/Pages/Shared/_Layout.cshtml?name=snippet&highlight=4)]
|
||||
|
||||
* Add the `_CookieConsentPartial.cshtml` file to the project:
|
||||
|
||||
[!code-cshtml[Main](~/security/gdpr/sample/RP6.0/WebGDPR/Pages/Shared/_CookieConsentPartial.cshtml)]
|
||||
|
||||
* Select the ASP.NET Core [2.2 version](xref:security/gdpr?view=aspnetcore-2.2&preserve-view=true) of this article to read about the cookie consent feature.
|
||||
|
||||
## Encryption at rest
|
||||
|
||||
Some databases and storage mechanisms allow for encryption at rest. Encryption at rest:
|
||||
|
||||
* Encrypts stored data automatically.
|
||||
* Encrypts without configuration, programming, or other work for the software that accesses the data.
|
||||
* Is the easiest and safest option.
|
||||
* Allows the database to manage keys and encryption.
|
||||
|
||||
For example:
|
||||
|
||||
* Microsoft SQL and Azure SQL provide [Transparent Data Encryption](/sql/relational-databases/security/encryption/transparent-data-encryption) (TDE).
|
||||
* [SQL Azure encrypts the database by default](https://azure.microsoft.com/updates/newly-created-azure-sql-databases-encrypted-by-default/)
|
||||
* [Azure Blobs, Files, Table, and Queue Storage are encrypted by default](https://azure.microsoft.com/blog/announcing-default-encryption-for-azure-blobs-files-table-and-queue-storage/).
|
||||
|
||||
For databases that don't provide built-in encryption at rest, you may be able to use disk encryption to provide the same protection. For example:
|
||||
|
||||
* [BitLocker for Windows Server](/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server)
|
||||
* Linux:
|
||||
* [eCryptfs](https://launchpad.net/ecryptfs)
|
||||
* [EncFS](https://github.com/vgough/encfs).
|
||||
|
||||
## Additional resources
|
||||
|
||||
* [Microsoft.com/GDPR](https://www.microsoft.com/trustcenter/Privacy/GDPR)
|
||||
|
||||
:::moniker-end
|
||||
Loading…
Reference in New Issue