Dotnet-Monitor returns Http 401 on endpoints other than /metrics

Description

Currently Dotnet-Monitor is returning HTTP 401 Unauthorized for endpoints other than /metrics. We can’t find documentation either on what the value the Authorization header should be set, if that is a requirement.

The following endpoints are affected.

/processes
/dump/{pid?}
/gcdump/{pid?}
/trace/{pid?}
/logs/{pid?}

For example: Request:

GET /gcdump HTTP/1.1
Host: analytics.integration:52323
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1

Response:

HTTP/1.1 401 Unauthorized
Date: Tue, 02 Mar 2021 18:22:05 GMT
Server: Kestrel
Content-Length: 0

Configuration

The dotnet-monitor container configuration within AWS Fargate is as follows: Image: mcr.microsoft.com/dotnet/nightly/monitor:latest

Entry point ["dotnet-monitor","collect"]
Command ["--urls","http://*:52323","--metricUrls","http://*:52325"]

Regression?

Yes, this worked in a previous build or release

Other information

[josalem]

We do not recommend turning off authentication in production environments, but if you want to entirely disable authentication, you can pass the --no-auth flag when dotnet-monitor starts.

[CraigHead]

@josalem thank you for the new setting. We will work towards configuring authorization long-term and appreciate that input about production environments. We actually only keep the metrics urls enabled for Production, so the actual diagnostics stuff isn’t enabled for the time being (since this tool is still preview).