Table of Contents

MibCmsFrontEndServerBaseConfig

Introduction

This configuration is intended for the MibCmsFrontEndServerBaseConfig class, which manages front-end and middleware settings for the MIB CMS FrontEnd Server.

Keys - Default Section

rootUrl -> required
useFileManagementServiceForTsvDownload -> false
useMocks -> false
debugModeEnabled -> false
renderOnlyMibComponents -> false
defaultLanguage -> en-us
defaultSkin -> empty
startPage -> empty
DmmAssetImporterUrl -> empty
DmmAssetImporterUsername -> empty
DmmAssetImporterPassword -> empty
DmmWsUrl -> empty
DmmWsUsername -> empty
DmmWsPassword -> empty
googleAnalyticsTrackingId -> empty
tsvSlowExportLimit -> 3000
maximumCharacterLimit -> 100
advancedSearchHistoryMaxSize -> 10
logKestrel -> false
useOpenIdConnect -> false
requireHttpsOpenIdConnect -> true
correlationCookieLifetime -> 00:15:00
tokenRefreshWindow -> 00:02:00
deleteBatchSize -> 200
userConcurrencyServiceUrl -> empty
userConcurrencyPollingTime -> 00:00:10
userConcurrencyHealthProbeTimeout -> 00:00:02
userConcurrencyCachingDuration -> 12:00:00
enableUrlUpload -> true
useRandomBundleCacheKey -> false
ShowFullDebugPage -> false
corsHeaders -> *
corsMethods -> *
corsOrigins -> rootUrl
maxRequestBodySize -> 0
useEditHistoryMicroService -> false
enableAssemblyLoadingModeViaCustomFolder -> false
enableAssetLoadingViaCustomFolder -> false
customAssetContentPath -> empty
customAssetRequestPath -> empty
forceCacheControlOnStaticFiles -> false
whichFilesWillBeIgnoredByCacheControl -> empty
cacheControlMaxAge -> 31536000
LoadAllFieldsInMediaTypeIncludeCalls -> true
MaxFileSizeDefaultValue -> 1000000000
resizerUrl -> {imageUrl}
logo -> empty
colorPrimary -> green
colorSecondary -> empty
welcomeImage -> empty
cookieName -> empty
cookieExpireTimeSpan -> TimeSpan.MinValue
cookieSlidingExpiration -> true
frontendAppPath -> empty

Properties

RootUrl

Type: string
Description: Base URL for the application. Required. Throws exception if not set. Must be the real public URL the CMS is served from (e.g. https://cms.example.com), not a development/local address — it is also the default for CorsOrigins. A stale or local value (e.g. a leftover IIS Express/dotnet run ephemeral port such as http://localhost:56609) can leak into any URL derived from it.

Note (MEDIAIBOX-12140): The Source field no longer derives its data URL from RootUrl. It is served relative (/api/v2/global/sources) and resolved by the front against its own configured API base, like every other CMS API call. Previously the Source input built an absolute URL from RootUrl, so a misconfigured RootUrl would make that single field call the wrong host. This is fixed as of MEDIAIBOX-12140 (regression from MEDIAIBOX-7310).

Default value:

UseFileManagementServiceForTsvDownload

Type: boolean
Description: Enables use of file management service for TSV downloads.
Default value: false

UseMocks

Type: boolean
Description: Enables mock data for testing.
Default value: false

DebugMessagesEnabled

Type: boolean
Description: Enables debug messages.
Default value: false

RenderOnlyMibComponents

Type: boolean
Description: Renders only MIB components.
Default value: false

DefaultLanguage

Type: string
Description: Default language.
Default value: en-us

DefaultSkin

Type: string
Description: Default UI skin.
Default value: empty

StartPage

Type: string
Description: Start page URL or route.
Default value: empty

DmmAssetImporterUrl, DmmAssetImporterUsername, DmmAssetImporterPassword

Type: string
Description: DMM asset importer integration settings.
Default value:

DmmWsUrl, DmmWsUsername, DmmWsPassword

Type: string
Description: DMM web service integration settings.
Default value:

GoogleAnalyticsTrackingId

Type: string
Description: Google Analytics tracking ID.
Default value: empty

TsvSlowExportLimit

Type: int
Description: Limit for slow TSV exports.
Default value: 3000

MaximumCharacterLimit

Type: int
Description: Maximum character limit for fields.
Default value: 100

AdvancedSearchHistoryMaxSize

Type: int
Description: Maximum size of advanced search history.
Default value: 10

LogKestrel

Type: boolean
Description: Enables Kestrel logging.
Default value: false

UseOpenIdConnect

Type: boolean
Description: Enables OpenID Connect authentication.
Default value: false

RequireHttpsOpenIdConnect

Type: boolean
Description: Requires HTTPS for OpenID Connect.
Default value: true

CorrelationCookieLifetime

Type: TimeSpan
Description: Lifetime applied to the OAuth/OIDC .AspNetCore.Correlation.* cookie (CorrelationCookie.Expiration). Bounds how long a correlation cookie left by an authentication challenge lives on the browser. Kept short as defense in depth against cookie-jar buildup: on the real (non-XHR) navigation login path the cookie is consumed at /oauth/callback well within this window, so it only needs to be long enough for an interactive login to complete. Introduced in MEDIAIBOX-12238 (see also the surgical removal of these cookies on unauthenticated XHR challenges); each environment/operator can tune it per deployment.
Default value: 00:15:00

TokenRefreshWindow

Type: TimeSpan
Description: How close to access-token expiry the BFF proactively refreshes the token when handling a request. Was previously hardcoded to 10 minutes; combined with the React shell firing several parallel XHRs on boot, that opened a long window in which many concurrent requests all attempted a refresh with the same (rotating) refresh token, tripping the Authorization Server's replay detection and revoking the session. Lowered to a small clock-skew default and made configurable in MEDIAIBOX-12243; the refresh is now single-flight per session (concurrent requests sharing a refresh token collapse into a single token-endpoint call, the losers reuse the winner's result). See also the server-side refreshTokenReuseLeeway (MEDIAIBOX-12242).
Default value: 00:02:00

DeleteBatchSize

Type: int
Description: Batch size for delete operations.
Default value: 200

UserConcurrencyServiceUrl

Type: string
Description: URL for user concurrency service.
Default value: empty

UserConcurrencyPollingTime

Type: TimeSpan
Description: Polling interval for user concurrency.
Default value: 00:00:10

UserConcurrencyHealthProbeTimeout

Type: TimeSpan
Description: Short timeout applied by the BFF to the concurrency health probe (GET /api/v2/concurrency/health). When the concurrency service is unavailable or slow, the probe returns Unavailable in the body with HTTP 200 instead of blocking on the call or surfacing a server error.
Default value: 00:00:02

UserConcurrencyCachingDuration

Type: TimeSpan
Description: Caching duration for user concurrency.
Default value: 12:00:00

EnableUrlUpload

Type: boolean
Description: Enables upload via URL.
Default value: true

UseRandomBundleCacheKey

Type: boolean
Description: Uses random cache key for bundles.
Default value: false

ShowFullDebugPage

Type: boolean
Description: Shows full debug page.
Default value: false

CorsHeaders

Type: string
Description: CORS headers.
Default value: *

CorsMethods

Type: string
Description: CORS methods.
Default value: *

CorsOrigins

Type: string
Description: CORS origins.
Default value: rootUrl

MaxRequestBodySize

Type: long
Description: Maximum request body size.
Default value: 0

UseEditHistoryMicroService

Type: boolean
Description: Enables edit history microservice.
Default value: false

EnableAssemblyLoadingModeViaCustomFolder

Type: boolean
Description: Enables assembly loading from custom folder.
Default value: false

EnableAssetLoadingViaCustomFolder

Type: boolean
Description: Enables asset loading from custom folder.
Default value: false

CustomAssetContentPath

Type: string
Description: Path for custom asset content.
Default value: empty

CustomAssetRequestPath

Type: string
Description: Path for custom asset requests.
Default value: empty

ForceCacheControlOnStaticFiles

Type: boolean
Description: Forces cache control on static files.
Default value: false

WhichFilesWillBeIgnoredByCacheControl

Type: string[]
Description: Files ignored by cache control.
Default value: empty

CacheControlMaxAge

Type: int
Description: Max age for cache control (seconds).
Default value: 31536000

LoadAllFieldsInMediaTypeIncludeCalls

Type: boolean
Description: Loads all fields in media type include calls.
Default value: true

MaxFileSizeDefaultValue

Type: int
Description: Default max file size.
Default value: (see Constants.MaxFileSizeDefaultValue)

Type: string
Description: Logo image path or URL.
Default value: empty

ColorPrimary

Type: string
Description: Primary color.
Default value: green

ColorSecondary

Type: string
Description: Secondary color.
Default value: empty

WelcomeImage

Type: string
Description: Welcome image path or URL.
Default value: empty

CookieName

Type: string
Description: Cookie name.
Default value: empty

CookieExpireTimeSpan

Type: TimeSpan
Description: Cookie expiration timespan.
Default value: TimeSpan.MinValue

CookieSlidingExpiration

Type: boolean
Description: Enables sliding expiration for cookies.
Default value: true

FrontendAppPath

Type: string
Description: Path to the front-end app path. (e.g. /app)
Default value: empty
Example: Assuming that the CMS SPA is being served under https://samples.mediaibox.com.br/app, the value for this configuration should be /app.

Note (MEDIAIBOX-12282): This value now also decides where a deliberate sign-out returns the operator. /auth/logout used to hand the identity provider returnUrl ?? RootUrl, and the CMS SPA's account menu sends no returnUrl — so the destination fell back to the origin root, which serves the legacy interface (Home/Index → Display/{StartPage}). A sign-out that names no destination now resolves to this path instead; a returnUrl that names a page is still honoured verbatim. When this key is empty — which is the default — the server falls back to /app/, the path the SPA route is registered under, so the behaviour is correct without configuration. Set it whenever the SPA is served from a different path, exactly as the example above describes: the shell can rewrite a path it receives in a JSON payload, but it cannot rewrite the Location header of a redirect, so the server has to get this one right on its own. Recovery from an expired session is a separate flow and is unaffected — it still returns the operator to the page they were interrupted on.

Methods

UserConcurrencyServiceUrlHealth()

Returns the health check URL for the user concurrency service.

UserConcurrencyServiceUrlHealth(string excludeHealthCheck)

Returns the health check URL for the user concurrency service, excluding a specific health check.

CookieExpireTimeSpanDefined()

Returns true if CookieExpireTimeSpan is defined (not TimeSpan.MinValue).

GetImageFieldUrl(string imageUrl, string width = "", string height = "")

Returns a formatted image URL using the resizer URL pattern.

static GetSkins()

Returns all available skins from the configuration section "skins".

Example

MIBCMSFRONTENDSERVERBASECONFIG_ROOTURL=https://frontend.com 
MIBCMSFRONTENDSERVERBASECONFIG_DEFAULTLANGUAGE=pt-br 
MIBCMSFRONTENDSERVERBASECONFIG_DEFAULTSKIN=dark 
MIBCMSFRONTENDSERVERBASECONFIG_USEMOCKS=true 
MIBCMSFRONTENDSERVERBASECONFIG_ENABLEURLUPLOAD=false 
MIBCMSFRONTENDSERVERBASECONFIG_COOKIEEXPIRETIMESPAN=01:00:00 
MIBCMSFRONTENDSERVERBASECONFIG_CORSHEADERS=* 
MIBCMSFRONTENDSERVERBASECONFIG_CORSORIGINS=https://frontend.com

Who uses this configuration?

  • MibCmsFrontEndServer
  • Middleware and UI components in the MIB CMS platform
Edit this page