Add connection-level security to frontend

[JamesNK]

Description

This PR adds connection-level security to the frontend. The frontend can now only be accessed via the frontend point.

This change is required because the OTLP HTTP endpoint supports being accessed via browser, and we don't want people to be able to browser the dashboard UI via the OTLP HTTP endpoint.

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No - Will be discussed with OTLP HTTP changes
  • No
• Does the change require an update in our Aspire docs?
  • Yes
    • Link to aspire-docs issue:
  • No

Microsoft Reviewers: Open in CodeFlow

[drewnoakes]

This change is required because the OTLP HTTP endpoint supports being accessed via browser, and we don't want people to be able to browser the dashboard UI via the OTLP HTTP endpoint.

To confirm understanding, the issue before this PR was that a user can auth for OTLP HTTP then use that token to view the Dashboard?

[JamesNK]

I'm not sure. I didn't test what happens when someone accessed the browser dashboard when there wasn't a frontend cookie.

However, it was possible to view the dashboard via the OTLP HTTP port, which we want to prevent regardless of whether you're authenticated to view the dashboard or not.

[JamesNK]

It would be useful if you double checked ODIC still works. The test passes, but I'm not sure if that completely verifies it is working. I believe there was a manual test you ran when that auth type was added.

[drewnoakes]

LGTM. Just some nits.

I believe there was a manual test you ran when that auth type was added.

The manual test was for certificates, and Bala's team are running that test now. The OIDC tests here look good to me.