V Slots App
Slotomania Slots is the number one free slot machines game in the world! Exciting casino slots, seasonal albums, daily dashes, Sloto Club, slot tournaments - the fun never ends! Get this app while signed in. Old Vegas Slots – Play Original Classic Slot Machine Games Free. Get ready to play Old Vegas Slots in a stunning new way. Take a journey and visit world-famous Las Vegas landmarks and play free.
You’re browsing the documentation for v2.x and earlier. For v3.x, click here.
This page assumes you’ve already read the Components Basics. Read that first if you are new to components.
In 2.6.0, we introduced a new unified syntax (the v-slot
directive) for named and scoped slots. It replaces the slot
and slot-scope
attributes, which are now deprecated, but have not been removed and are still documented here. The rationale for introducing the new syntax is described in this RFC.
Slot Content
Vue implements a content distribution API inspired by the Web Components spec draft, using the <slot>
element to serve as distribution outlets for content.
This allows you to compose components like this:
Then in the template for <navigation-link>
, you might have:
When the component renders, <slot></slot>
will be replaced by “Your Profile”. Slots can contain any template code, including HTML:
Or even other components:
If <navigation-link>
‘s template did not contain a <slot>
element, any content provided between its opening and closing tag would be discarded.
Compilation Scope
When you want to use data inside a slot, such as in:
That slot has access to the same instance properties (i.e. the same “scope”) as the rest of the template. The slot does not have access to <navigation-link>
‘s scope. For example, trying to access url
would not work:
As a rule, remember that:
Everything in the parent template is compiled in parent scope; everything in the child template is compiled in the child scope.
Fallback Content
There are cases when it’s useful to specify fallback (i.e. default) content for a slot, to be rendered only when no content is provided. For example, in a <submit-button>
component:
We might want the text “Submit” to be rendered inside the <button>
most of the time. To make “Submit” the fallback content, we can place it in between the <slot>
tags:
Now when we use <submit-button>
in a parent component, providing no content for the slot:
will render the fallback content, “Submit”:
But if we provide content:
Then the provided content will be rendered instead:
Named Slots
Updated in 2.6.0+. See here for the deprecated syntax using the slot
attribute.
There are times when it’s useful to have multiple slots. For example, in a <base-layout>
component with the following template:
For these cases, the <slot>
element has a special attribute, name
, which can be used to define additional slots:
A <slot>
outlet without name
implicitly has the name “default”.
To provide content to named slots, we can use the v-slot
directive on a <template>
, providing the name of the slot as v-slot
‘s argument:
Now everything inside the <template>
elements will be passed to the corresponding slots. Any content not wrapped in a <template>
using v-slot
is assumed to be for the default slot.
However, you can still wrap default slot content in a <template>
if you wish to be explicit:
Either way, the rendered HTML will be:
Note that v-slot
can only be added to a <template>
(with one exception), unlike the deprecated slot
attribute.
Scoped Slots
Updated in 2.6.0+. See here for the deprecated syntax using the slot-scope
attribute.
Sometimes, it’s useful for slot content to have access to data only available in the child component. For example, imagine a <current-user>
component with the following template:
We might want to replace this fallback content to display the user’s first name, instead of last, like this:
That won’t work, however, because only the <current-user>
component has access to the user
and the content we’re providing is rendered in the parent.
To make user
available to the slot content in the parent, we can bind user
as an attribute to the <slot>
element:
Attributes bound to a <slot>
element are called slot props. Now, in the parent scope, we can use v-slot
with a value to define a name for the slot props we’ve been provided:
In this example, we’ve chosen to name the object containing all our slot props slotProps
, but you can use any name you like.
Abbreviated Syntax for Lone Default Slots
In cases like above, when only the default slot is provided content, the component’s tags can be used as the slot’s template. This allows us to use v-slot
directly on the component:
This can be shortened even further. Just as non-specified content is assumed to be for the default slot, v-slot
without an argument is assumed to refer to the default slot:
Note that the abbreviated syntax for default slot cannot be mixed with named slots, as it would lead to scope ambiguity:
Whenever there are multiple slots, use the full <template>
based syntax for all slots:
Destructuring Slot Props
Internally, scoped slots work by wrapping your slot content in a function passed a single argument:
That means the value of v-slot
can actually accept any valid JavaScript expression that can appear in the argument position of a function definition. So in supported environments (single-file components or modern browsers), you can also use ES2015 destructuring to pull out specific slot props, like so:
This can make the template much cleaner, especially when the slot provides many props. It also opens other possibilities, such as renaming props, e.g. user
to person
:
You can even define fallbacks, to be used in case a slot prop is undefined:
Dynamic Slot Names
New in 2.6.0+
Dynamic directive arguments also work on v-slot
, allowing the definition of dynamic slot names:
Named Slots Shorthand
New in 2.6.0+
Similar to v-on
and v-bind
, v-slot
also has a shorthand, replacing everything before the argument (v-slot:
) with the special symbol #
. For example, v-slot:header
can be rewritten as #header
:
However, just as with other directives, the shorthand is only available when an argument is provided. That means the following syntax is invalid:
Instead, you must always specify the name of the slot if you wish to use the shorthand:
Other Examples
Slot props allow us to turn slots into reusable templates that can render different content based on input props. This is most useful when you are designing a reusable component that encapsulates data logic while allowing the consuming parent component to customize part of its layout.
For example, we are implementing a <todo-list>
component that contains the layout and filtering logic for a list:
Instead of hard-coding the content for each todo, we can let the parent component take control by making every todo a slot, then binding todo
as a slot prop:
Now when we use the <todo-list>
component, we can optionally define an alternative <template>
for todo items, but with access to data from the child:
However, even this barely scratches the surface of what scoped slots are capable of. For real-life, powerful examples of scoped slot usage, we recommend browsing libraries such as Vue Virtual Scroller, Vue Promised, and Portal Vue.
Deprecated Syntax
The v-slot
directive was introduced in Vue 2.6.0, offering an improved, alternative API to the still-supported slot
and slot-scope
attributes. The full rationale for introducing v-slot
is described in this RFC. The slot
and slot-scope
attributes will continue to be supported in all future 2.x releases, but are officially deprecated and will eventually be removed in Vue 3.
Named Slots with the slot
Attribute
Deprecated in 2.6.0+. See here for the new, recommended syntax.
To pass content to named slots from the parent, use the special slot
attribute on <template>
(using the <base-layout>
component described here as example):
Or, the slot
attribute can also be used directly on a normal element:
There can still be one unnamed slot, which is the default slot that serves as a catch-all for any unmatched content. In both examples above, the rendered HTML would be:
Scoped Slots with the slot-scope
Attribute
Deprecated in 2.6.0+. See here for the new, recommended syntax.
To receive props passed to a slot, the parent component can use <template>
with the slot-scope
attribute (using the <slot-example>
described here as example):
Here, slot-scope
declares the received props object as the slotProps
variable, and makes it available inside the <template>
scope. You can name slotProps
anything you like similar to naming function arguments in JavaScript.
Here slot='default'
can be omitted as it is implied:
The slot-scope
attribute can also be used directly on a non-<template>
element (including components):
The value of slot-scope
can accept any valid JavaScript expression that can appear in the argument position of a function definition. This means in supported environments (single-file components or modern browsers) you can also use ES2015 destructuring in the expression, like so:
Using the <todo-list>
described here as an example, here’s the equivalent usage using slot-scope
:
This article shows you how to customize the built-in authentication and authorization in App Service, and to manage identity from your application.
To get started quickly, see one of the following tutorials:
Use multiple sign-in providers
The portal configuration doesn't offer a turn-key way to present multiple sign-in providers to your users (such as both Facebook and Twitter). However, it isn't difficult to add the functionality to your app. The steps are outlined as follows:
First, in the Authentication / Authorization page in the Azure portal, configure each of the identity provider you want to enable.
In Action to take when request is not authenticated, select Allow Anonymous requests (no action).
In the sign-in page, or the navigation bar, or any other location of your app, add a sign-in link to each of the providers you enabled (/.auth/login/<provider>
). For example:
When the user clicks on one of the links, the respective sign-in page opens to sign in the user.
To redirect the user post-sign-in to a custom URL, use the post_login_redirect_url
query string parameter (not to be confused with the Redirect URI in your identity provider configuration). For example, to navigate the user to /Home/Index
after sign-in, use the following HTML code:
Validate tokens from providers
In a client-directed sign-in, the application signs in the user to the provider manually and then submits the authentication token to App Service for validation (see Authentication flow). This validation itself doesn't actually grant you access to the desired app resources, but a successful validation will give you a session token that you can use to access app resources.
To validate the provider token, App Service app must first be configured with the desired provider. At runtime, after you retrieve the authentication token from your provider, post the token to /.auth/login/<provider>
for validation. For example:
The token format varies slightly according to the provider. See the following table for details:
Provider value | Required in request body | Comments |
---|---|---|
aad | {'access_token':'<access_token>'} | |
microsoftaccount | {'access_token':'<token>'} | The expires_in property is optional. When requesting the token from Live services, always request the wl.basic scope. |
google | {'id_token':'<id_token>'} | The authorization_code property is optional. When specified, it can also optionally be accompanied by the redirect_uri property. |
facebook | {'access_token':'<user_access_token>'} | Use a valid user access token from Facebook. |
twitter | {'access_token':'<access_token>', 'access_token_secret':'<acces_token_secret>'} |
If the provider token is validated successfully, the API returns with an authenticationToken
in the response body, which is your session token.
Once you have this session token, you can access protected app resources by adding the X-ZUMO-AUTH
header to your HTTP requests. For example:
Sign out of a session
Users can initiate a sign-out by sending a GET
request to the app's /.auth/logout
endpoint. The GET
request does the following:
- Clears authentication cookies from the current session.
- Deletes the current user's tokens from the token store.
- For Azure Active Directory and Google, performs a server-side sign-out on the identity provider.
Here's a simple sign-out link in a webpage:
By default, a successful sign-out redirects the client to the URL /.auth/logout/done
. You can change the post-sign-out redirect page by adding the post_logout_redirect_uri
query parameter. For example:
It's recommended that you encode the value of post_logout_redirect_uri
.
When using fully qualified URLs, the URL must be either hosted in the same domain or configured as an allowed external redirect URL for your app. In the following example, to redirect to https://myexternalurl.com
that's not hosted in the same domain:
Run the following command in the Azure Cloud Shell:
Preserve URL fragments
After users sign in to your app, they usually want to be redirected to the same section of the same page, such as /wiki/Main_Page#SectionZ
. However, because URL fragments (for example, #SectionZ
) are never sent to the server, they are not preserved by default after the OAuth sign-in completes and redirects back to your app. Users then get a suboptimal experience when they need to navigate to the desired anchor again. This limitation applies to all server-side authentication solutions.
In App Service authentication, you can preserve URL fragments across the OAuth sign-in. To do this, set an app setting called WEBSITE_AUTH_PRESERVE_URL_FRAGMENT
to true
. You can do it in the Azure portal, or simply run the following command in the Azure Cloud Shell:
Access user claims
App Service passes user claims to your application by using special headers. External requests aren't allowed to set these headers, so they are present only if set by App Service. Some example headers include:
- X-MS-CLIENT-PRINCIPAL-NAME
- X-MS-CLIENT-PRINCIPAL-ID
Code that is written in any language or framework can get the information that it needs from these headers. For ASP.NET 4.6 apps, the ClaimsPrincipal is automatically set with the appropriate values. ASP.NET Core, however, doesn't provide an authentication middleware that integrates with App Service user claims. For a workaround, see MaximeRouiller.Azure.AppService.EasyAuth.
If the token store is enabled for your app, you can also obtain additional details on the authenticated user by calling /.auth/me
. The Mobile Apps server SDKs provide helper methods to work with this data. For more information, see How to use the Azure Mobile Apps Node.js SDK, and Work with the .NET backend server SDK for Azure Mobile Apps.
Retrieve tokens in app code
From your server code, the provider-specific tokens are injected into the request header, so you can easily access them. The following table shows possible token header names:
Provider | Header names |
---|---|
Azure Active Directory | X-MS-TOKEN-AAD-ID-TOKEN X-MS-TOKEN-AAD-ACCESS-TOKEN X-MS-TOKEN-AAD-EXPIRES-ON X-MS-TOKEN-AAD-REFRESH-TOKEN |
Facebook Token | X-MS-TOKEN-FACEBOOK-ACCESS-TOKEN X-MS-TOKEN-FACEBOOK-EXPIRES-ON |
X-MS-TOKEN-GOOGLE-ID-TOKEN X-MS-TOKEN-GOOGLE-ACCESS-TOKEN X-MS-TOKEN-GOOGLE-EXPIRES-ON X-MS-TOKEN-GOOGLE-REFRESH-TOKEN | |
Microsoft Account | X-MS-TOKEN-MICROSOFTACCOUNT-ACCESS-TOKEN X-MS-TOKEN-MICROSOFTACCOUNT-EXPIRES-ON X-MS-TOKEN-MICROSOFTACCOUNT-AUTHENTICATION-TOKEN X-MS-TOKEN-MICROSOFTACCOUNT-REFRESH-TOKEN |
X-MS-TOKEN-TWITTER-ACCESS-TOKEN X-MS-TOKEN-TWITTER-ACCESS-TOKEN-SECRET |
From your client code (such as a mobile app or in-browser JavaScript), send an HTTP GET
request to /.auth/me
(token store must be enabled). The returned JSON has the provider-specific tokens.
Note
Access tokens are for accessing provider resources, so they are present only if you configure your provider with a client secret. To see how to get refresh tokens, see Refresh access tokens.
Refresh identity provider tokens
When your provider's access token (not the session token) expires, you need to reauthenticate the user before you use that token again. You can avoid token expiration by making a GET
call to the /.auth/refresh
endpoint of your application. When called, App Service automatically refreshes the access tokens in the token store for the authenticated user. Subsequent requests for tokens by your app code get the refreshed tokens. However, for token refresh to work, the token store must contain refresh tokens for your provider. The way to get refresh tokens are documented by each provider, but the following list is a brief summary:
- Google: Append an
access_type=offline
query string parameter to your/.auth/login/google
API call. If using the Mobile Apps SDK, you can add the parameter to one of theLogicAsync
overloads (see Google Refresh Tokens). - Facebook: Doesn't provide refresh tokens. Long-lived tokens expire in 60 days (see Facebook Expiration and Extension of Access Tokens).
- Twitter: Access tokens don't expire (see Twitter OAuth FAQ).
- Microsoft Account: When configuring Microsoft Account Authentication Settings, select the
wl.offline_access
scope. - Azure Active Directory: In https://resources.azure.com, do the following steps:
At the top of the page, select Read/Write.
In the left browser, navigate to subscriptions > <subscription_name > resourceGroups > <resource_group_name> > providers > Microsoft.Web > sites > <app_name> > config > authsettings.
Click Edit.
Modify the following property. Replace <app_id> with the Azure Active Directory application ID of the service you want to access.
Click Put.
Once your provider is configured, you can find the refresh token and the expiration time for the access token in the token store.
To refresh your access token at any time, just call /.auth/refresh
in any language. The following snippet uses jQuery to refresh your access tokens from a JavaScript client.
If a user revokes the permissions granted to your app, your call to /.auth/me
may fail with a 403 Forbidden
response. To diagnose errors, check your application logs for details.
Extend session token expiration grace period
The authenticated session expires after 8 hours. After an authenticated session expires, there is a 72-hour grace period by default. Within this grace period, you're allowed to refresh the session token with App Service without reauthenticating the user. You can just call /.auth/refresh
when your session token becomes invalid, and you don't need to track token expiration yourself. Once the 72-hour grace period is lapses, the user must sign in again to get a valid session token.
If 72 hours isn't enough time for you, you can extend this expiration window. Extending the expiration over a long period could have significant security implications (such as when an authentication token is leaked or stolen). So you should leave it at the default 72 hours or set the extension period to the smallest value.
To extend the default expiration window, run the following command in the Cloud Shell.
Note
The grace period only applies to the App Service authenticated session, not the tokens from the identity providers. There is no grace period for the expired provider tokens.
Limit the domain of sign-in accounts
Both Microsoft Account and Azure Active Directory lets you sign in from multiple domains. For example, Microsoft Account allows outlook.com, live.com, and hotmail.com accounts. Azure AD allows any number of custom domains for the sign-in accounts. However, you may want to accelerate your users straight to your own branded Azure AD sign-in page (such as contoso.com
). To suggest the domain name of the sign-in accounts, follow these steps.
In https://resources.azure.com, navigate to subscriptions > <subscription_name > resourceGroups > <resource_group_name> > providers > Microsoft.Web > sites > <app_name> > config > authsettings.
Click Edit, modify the following property, and then click Put. Be sure to replace <domain_name> with the domain you want.
This setting appends the domain_hint
query string parameter to the login redirect URL.
Important
It's possible for the client to remove the domain_hint
parameter after receiving the redirect URL, and then login with a different domain. So while this function is convenient, it's not a security feature.
Authorize or deny users
While App Service takes care of the simplest authorization case (i.e. reject unauthenticated requests), your app may require more fine-grained authorization behavior, such as limiting access to only a specific group of users. In certain cases, you need to write custom application code to allow or deny access to the signed-in user. In other cases, App Service or your identity provider may be able to help without requiring code changes.
Server level (Windows apps only)
For any Windows app, you can define authorization behavior of the IIS web server, by editing the Web.config file. Linux apps don't use IIS and can't be configured through Web.config.
Navigate to
https://<app-name>.scm.azurewebsites.net/DebugConsole
In the browser explorer of your App Service files, navigate to site/wwwroot. If a Web.config doesn't exist, create it by selecting + > New File.
Select the pencil for Web.config to edit it. Add the following configuration code and click Save. If Web.config already exists, just add the
<authorization>
element with everything in it. Add the accounts you want to allow in the<allow>
element.
Identity provider level
The identity provider may provide certain turn-key authorization. For example:
- For Azure App Service, you can manage enterprise-level access directly in Azure AD. For instructions, see How to remove a user's access to an application.
- For Google, Google API projects that belong to an organization can be configured to allow access only to users in your organization (see Google's Setting up OAuth 2.0 support page).
Application level
If either of the other levels don't provide the authorization you need, or if your platform or identity provider isn't supported, you must write custom code to authorize users based on the user claims.
Updating the configuration version (preview)
There are two versions of the management API for the Authentication / Authorization feature. The preview V2 version is required for the 'Authentication (preview)' experience in the Azure portal. An app already using the V1 API can upgrade to the V2 version once a few changes have been made. Specifically, secret configuration must be moved to slot-sticky application settings. Configuration of the Microsoft Account provider is also not supported in V2 presently.
Warning
Migration to the V2 preview will disable management of the App Service Authentication / Authorization feature for your application through some clients, such as its existing experience in the Azure portal, Azure CLI, and Azure PowerShell. This cannot be reversed. During the preview, migration of production workloads is not encouraged or supported. You should only follow the steps in this section for test applications.
Moving secrets to application settings
Get your existing configuration by using the V1 API:
In the resulting JSON payload, make note of the secret value used for each provider you have configured:
- AAD:
clientSecret
- Google:
googleClientSecret
- Facebook:
facebookAppSecret
- Twitter:
twitterConsumerSecret
- Microsoft Account:
microsoftAccountClientSecret
Important
The secret values are important security credentials and should be handled carefully. Do not share these values or persist them on a local machine.
- AAD:
Create slot-sticky application settings for each secret value. You may choose the name of each application setting. It's value should match what you obtained in the previous step or reference a Key Vault secret that you have created with that value.
To create the setting, you can use the Azure portal or run a variation of the following for each provider:
Note
The application settings for this configuration should be marked as slot-sticky, meaning that they will not move between environments during a slot swap operation. This is because your authentication configuration itself is tied to the environment.
Create a new JSON file named
authsettings.json
.Take the output that you received previously and remove each secret value from it. Write the remaining output to the file, making sure that no secret is included. In some cases, the configuration may have arrays containing empty strings. Make sure thatmicrosoftAccountOAuthScopes
does not, and if it does, switch that value tonull
.Add a property to
authsettings.json
which points to the application setting name you created earlier for each provider:- AAD:
clientSecretSettingName
- Google:
googleClientSecretSettingName
- Facebook:
facebookAppSecretSettingName
- Twitter:
twitterConsumerSecretSettingName
- Microsoft Account:
microsoftAccountClientSecretSettingName
An example file after this operation might look similar to the following, in this case only configured for AAD:
- AAD:
Submit this file as the new Authentication/Authorization configuration for your app:
Validate that your app is still operating as expected after this gesture.
Delete the file used in the previous steps.
You have now migrated the app to store identity provider secrets as application settings.
Support for Microsoft account registrations
The V2 API does not currently support Microsoft Account as a distinct provider. Rather, it leverages the converged Microsoft Identity Platform to sign-in users with personal Microsoft accounts. When switching to the V2 API, the V1 Azure Active Directory configuration is used to configure the Microsoft Identity Platform provider.
If your existing configuration contains a Microsoft Account provider and does not contain an Azure Active Directory provider, you can switch the configuration over to the Azure Active Directory provider and then perform the migration. To do this:
- Go to App registrations in the Azure portal and find the registration associated with your Microsoft Account provider. It may be under the 'Applications from personal account' heading.
- Navigate to the 'Authentication' page for the registration. Under 'Redirect URIs' you should see an entry ending in
/.auth/login/microsoftaccount/callback
. Copy this URI. - Add a new URI that matches the one you just copied, except instead have it end in
/.auth/login/aad/callback
. This will allow the registration to be used by the App Service Authentication / Authorization configuration. - Navigate to the App Service Authentication / Authorization configuration for your app.
- Collect the configuration for the Microsoft Account provider.
- Configure the Azure Active Directory provider using the 'Advanced' management mode, supplying the client ID and client secret values you collected in the previous step. For the Issuer URL, use Use
<authentication-endpoint>/<tenant-id>/v2.0
, and replace <authentication-endpoint> with the authentication endpoint for your cloud environment (e.g., 'https://login.microsoftonline.com' for global Azure), also replacing <tenant-id> with your Directory (tenant) ID. - Once you have saved the configuration, test the login flow by navigating in your browser to the
/.auth/login/aad
endpoint on your site and complete the sign-in flow. - At this point, you have successfully copied the configuration over, but the existing Microsoft Account provider configuration remains. Before you remove it, make sure that all parts of your app reference the Azure Active Directory provider through login links, etc. Verify that all parts of your app work as expected.
- Once you have validated that things work against the AAD Azure Active Directory provider, you may remove the Microsoft Account provider configuration.
Some apps may already have separate registrations for Azure Active Directory and Microsoft Account. Those apps cannot be migrated at this time.
Warning
It is possible to converge the two registrations by modifying the supported account types for the AAD app registration. However, this would force a new consent prompt for Microsoft Account users, and those users' identity claims may be different in structure, sub
notably changing values since a new App ID is being used. This approach is not recommended unless thoroughly understood. You should instead wait for support for the two registrations in the V2 API surface.
Switching to V2
Once the above steps have been performed, navigate to the app in the Azure portal. Select the 'Authentication (preview)' section.
Alternatively, you may make a PUT request against the config/authsettingsv2
resource under the site resource. The schema for the payload is the same as captured in the Configure using a file section.
Configure using a file (preview)
Your auth settings can optionally be configured via a file that is provided by your deployment. This may be required by certain preview capabilities of App Service Authentication / Authorization.
Important
Remember that your app payload, and therefore this file, may move between environments, as with slots. It is likely you would want a different app registration pinned to each slot, and in these cases, you should continue to use the standard configuration method instead of using the configuration file.
Enabling file-based configuration
Caution
During preview, enabling file-based configuration will disable management of the App Service Authentication / Authorization feature for your application through some clients, such as the Azure portal, Azure CLI, and Azure PowerShell.
Create a new JSON file for your configuration at the root of your project (deployed to D:homesitewwwroot in your web / function app). Fill in your desired configuration according to the file-based configuration reference. If modifying an existing Azure Resource Manager configuration, make sure to translate the properties captured in the
authsettings
collection into your configuration file.Modify the existing configuration, which is captured in the Azure Resource Manager APIs under
Microsoft.Web/sites/<siteName>/config/authsettings
. To modify this, you can use an Azure Resource Manager template or a tool like Azure Resource Explorer. Within the authsettings collection, you will need to set three properties (and may remove others):- Set
enabled
to 'true' - Set
isAuthFromFile
to 'true' - Set
authFilePath
to the name of the file (for example, 'auth.json')
- Set
Note
The format for authFilePath
varies between platforms. On Windows, both relative and absolute paths are supported. Relative is recommended. For Linux, only absolute paths are supported currently, so the value of the setting should be '/home/site/wwwroot/auth.json' or similar.
Once you have made this configuration update, the contents of the file will be used to define the behavior of App Service Authentication / Authorization for that site. If you ever wish to return to Azure Resource Manager configuration, you can do so by setting isAuthFromFile
back to 'false'.
Configuration file reference
Any secrets that will be referenced from your configuration file must be stored as application settings. You may name the settings anything you wish. Just make sure that the references from the configuration file uses the same keys.
The following exhausts possible configuration options within the file:
Pin your app to a specific authentication runtime version
When you enable Authentication / Authorization, platform middleware is injected into your HTTP request pipeline as described in the feature overview. This platform middleware is periodically updated with new features and improvements as part of routine platform updates. By default, your web or function app will run on the latest version of this platform middleware. These automatic updates are always backwards compatible. However, in the rare event that this automatic update introduces a runtime issue for your web or function app, you can temporarily roll back to the previous middleware version. This article explains how to temporarily pin an app to a specific version of the authentication middleware.
Automatic and manual version updates
You can pin your app to a specific version of the platform middleware by setting a runtimeVersion
setting for the app. Your app always runs on the latest version unless you choose to explicitly pin it back to a specific version. There will be a few versions supported at a time. If you pin to an invalid version that is no longer supported, your app will use the latest version instead. To always run the latest version, set runtimeVersion
to ~1.
View and update the current runtime version
You can change the runtime version used by your app. The new runtime version should take effect after restarting the app.
View the current runtime version
You can view the current version of the platform authentication middleware either using the Azure CLI or via one of the built-in version HTTP endpoints in your app.
From the Azure CLI
Using the Azure CLI, view the current middleware version with the az webapp auth show command.
In this code, replace <my_app_name>
with the name of your app. Also replace <my_resource_group>
with the name of the resource group for your app.
You will see the runtimeVersion
field in the CLI output. It will resemble the following example output, which has been truncated for clarity:
From the version endpoint
You can also hit /.auth/version endpoint on an app also to view the current middleware version that the app is running on. It will resemble the following example output:
Update the current runtime version
Using the Azure CLI, you can update the runtimeVersion
setting in the app with the az webapp auth update command.
Replace <my_app_name>
with the name of your app. Also replace <my_resource_group>
with the name of the resource group for your app. Also, replace <version>
with a valid version of the 1.x runtime or ~1
for the latest version. You can find the release notes on the different runtime versions [here] (https://github.com/Azure/app-service-announcements) to help determine the version to pin to.
You can run this command from the Azure Cloud Shell by choosing Try it in the preceding code sample. You can also use the Azure CLI locally to execute this command after executing az login to sign in.