Class ClientGate

Namespace

FishMMO.WebShared

Assembly

FishMMO-WebShared.dll

Verifies the X-FishMMO-Client signature on incoming requests. See FishMMO-Unity/Assets/Scripts/Client/Launcher/ClientApiSigner.cs for the matching client-side producer and the canonical-string format.

The gate is intentionally lightweight: it filters out generic crawlers and casual scanners that don't ship the signed header, and it adds an anti-replay window so a captured header is useful only for 30 seconds. It is NOT an authentication mechanism — the shared secret is compiled into the public client and any motivated attacker can extract it. All real authority comes from the SRP/token flow inside the application.

public static class ClientGate

Inheritance

object

ClientGate

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Methods

UseFishMMOClientGate(IApplicationBuilder, IHostEnvironment, string?, params string[])

Adds the gate middleware. The shared secret is loaded from the database and passed via the gateSecret parameter. If the secret is null in Production the host refuses to start; in other environments it logs loudly and lets requests through so local dev isn't blocked by an unconfigured database.

Paths in bypassPaths (case-insensitive, prefix match) skip the gate. Use this for liveness probes that must work without the shared secret (e.g., /healthz on loopback).

public static IApplicationBuilder UseFishMMOClientGate(this IApplicationBuilder app, IHostEnvironment environment, string? gateSecret, params string[] bypassPaths)

Parameters

app IApplicationBuilder

environment IHostEnvironment

gateSecret string

bypassPaths string[]

Returns

IApplicationBuilder