agent/agent-framework
2
0
Fork 0
mirror of https://github.com/microsoft/agent-framework.git synced 2026-06-16 21:04:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

[Generated by SRE Agent] Clarify identifier security guidance

Browse Source 
Co-authored-by: Azure SRE Agent <noreply@microsoft.com>
This commit is contained in:
Azure SRE Agent
2026-06-14 06:27:55 +00:00
Unverified
parent ed4ff188fc
commit 43aaf58821
3 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dotnet/samples/02-agents/AGUI/README.md
+6
View File
@@ -224,6 +224,12 @@ dotnet run
- **Thread IDs** (as `ConversationId`) for conversation context
- **Run IDs** (as `ResponseId`) for tracking individual executions
## Security considerations
`ConversationId` keeps request/response continuity. It is not proof that the caller owns that conversation. In multi-user deployments, authenticate each AG-UI request and authorize conversation access using your application's real boundary, such as the authenticated user, tenant, or workspace.
If your ASP.NET Core host shares session storage across users, pair `MapAGUI` with an isolation strategy such as `UseClaimsBasedSessionIsolation(...)` so the storage key includes a principal-specific dimension instead of relying on the conversation identifier alone.
## Troubleshooting
### Connection Refused