Stratara.ServiceDefaults.AspNetCore
4.6.0
Prefix Reserved
dotnet add package Stratara.ServiceDefaults.AspNetCore --version 4.6.0
NuGet\Install-Package Stratara.ServiceDefaults.AspNetCore -Version 4.6.0
<PackageReference Include="Stratara.ServiceDefaults.AspNetCore" Version="4.6.0" />
<PackageVersion Include="Stratara.ServiceDefaults.AspNetCore" Version="4.6.0" />
<PackageReference Include="Stratara.ServiceDefaults.AspNetCore" />
paket add Stratara.ServiceDefaults.AspNetCore --version 4.6.0
#r "nuget: Stratara.ServiceDefaults.AspNetCore, 4.6.0"
#:package Stratara.ServiceDefaults.AspNetCore@4.6.0
#addin nuget:?package=Stratara.ServiceDefaults.AspNetCore&version=4.6.0
#tool nuget:?package=Stratara.ServiceDefaults.AspNetCore&version=4.6.0
Stratara.ServiceDefaults.AspNetCore
Derived. The behaviour described here is specified under
openspec/specs/. Those specifications are the source; this page explains and illustrates them.
License: MIT.
ASP.NET Core extensions on top of Stratara.ServiceDefaults. Reference from every API host.
What's in the box
| Extension | Purpose |
|---|---|
AddDefaultHealthChecks |
Registers a self-tagged health check that always reports Healthy + tags it as live so the /alive predicate can filter on it. |
MapDefaultEndpoints |
Maps /health (full health-check report) and /alive (only the live-tagged checks). |
ConfigureAspNetOpenTelemetry |
Wires ASP.NET Core request instrumentation on metrics + tracing; filters out the health-check + aliveness endpoints from traces so they don't pollute the request stream. |
Quick start
builder.ConfigureOpenTelemetry(); // from Stratara.ServiceDefaults
builder.ConfigureAspNetOpenTelemetry(); // from this package
builder.AddDefaultHealthChecks();
builder.ConfigureSerilog(); // from Stratara.ServiceDefaults
var app = builder.Build();
app.MapDefaultEndpoints();
Dependencies
Stratara.ServiceDefaults— baseConfigureOpenTelemetryand shared endpoint constants.OpenTelemetry.Extensions.Hosting+OpenTelemetry.Instrumentation.AspNetCore.
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed. |
-
net10.0
- OpenTelemetry.Extensions.Hosting (>= 1.20.1)
- OpenTelemetry.Instrumentation.AspNetCore (>= 1.20.1)
- Stratara.ServiceDefaults (>= 4.6.0)
NuGet packages
This package is not used by any NuGet packages.
GitHub repositories
This package is not used by any popular GitHub repositories.
| Version | Downloads | Last Updated |
|---|---|---|
| 4.6.0 | 0 | 10/28/2026 |
| 4.5.0 | 0 | 10/28/2026 |
| 4.4.10 | 158 | 10/26/2026 |
| 4.4.9 | 91 | 10/26/2026 |
| 4.4.8 | 238 | 10/24/2026 |
| 4.4.7 | 106 | 10/23/2026 |
| 4.4.6 | 205 | 10/22/2026 |
| 4.4.5 | 276 | 10/14/2026 |
| 4.4.4 | 285 | 10/10/2026 |
| 4.4.3 | 110 | 10/10/2026 |
| 4.4.2 | 388 | 10/2/2026 |
| 4.4.1 | 359 | 9/29/2026 |
| 4.4.0 | 125 | 9/27/2026 |
| 4.3.1 | 132 | 9/25/2026 |
| 4.3.0 | 302 | 9/23/2026 |
| 4.2.0 | 149 | 9/18/2026 |
| 4.1.1 | 88 | 9/16/2026 |
| 4.1.0 | 103 | 9/16/2026 |
| 4.0.4 | 828 | 9/14/2026 |
| 4.0.3 | 117 | 9/3/2026 |
An erasure shreds every key that names the subject, and nothing stopped the next encryption for that subject
from creating a new one: a key store asked for a scope it does not hold creates a first version. A job, a request
in flight or a second process that encrypted for an erased subject afterwards got a fresh key, and what it wrote
stayed readable for good. The key store now records an erased subject and refuses to create a key for it again.
### Added
- **`IKeyStore.MarkSubjectErasedAsync(KeySubject)`** records that a tenant or user has been erased. It has a
default implementation that throws `NotSupportedException`, so an existing key store still compiles.
- **`KeySubject`** names the tenant or user, and `KeySubject.Covers(KeyScope)` states which keys belong to its
erasure: for a tenant, a key of any level that names it; for a user, a user-level key that names it.
- **`KeyScopeErasedException`** (an `InvalidOperationException`) is what a key store throws for such a scope. It
carries the refused `Scope`.
### Changed
- **An encryption for an erased subject fails.** After a subject's erasure, `GetOrCreateCurrentKeyAsync` and
`RotateAsync` throw `KeyScopeErasedException` for every scope the subject covers, whether or not it ever held a
key, and create nothing. The blob encryptor, the encrypting settings store and the field-encrypting serializer
pass it through. Code that erased a subject and then wrote encrypted data for it again now sees the exception;
the mark is permanent and cannot be lifted. Revoking every version of a scope is not an erasure and marks nothing.
- **`ISubjectEraser` marks the subject before it sweeps any plane**, so an encryption racing the erasure
either creates its key first, and that key is shredded with the rest, or is refused. A key store that cannot mark
a subject leaves the erasure as before and logs `SubjectNotMarkable` (112009).
- **The file-backed key store writes format version 2**, which holds the marks, and refuses to open a file in a
newer format than it knows. `InMemoryKeyStore` refuses an erased subject as the file store does; `DummyKeyStore`
refuses to mark one, as it refuses every erasure operation.
**Upgrading:**
- **Upgrade every process that shares a key store file in one step.** A process on an earlier release reads a
version-2 file, ignores the marks, creates keys for an erased subject and drops the marks the next time it writes
the file. A version-1 file needs no migration. Rolling back is possible but loses the marks on the first write.
- **Map `KeyScopeErasedException` to your answer for data that is gone**, if a request can reach an encryption for
a subject after its erasure.
- **A key store of your own implements `MarkSubjectErasedAsync`**, refusing in `GetOrCreateCurrentKeyAsync` and
`RotateAsync` every scope a marked subject `Covers`. Without it the erasure warns and the gap stays open.