[westey (westey-m)]

Motivation & Context

Improve DevUI's local request handling so its UI and standard Responses and Conversations endpoints consistently accept expected local traffic while rejecting requests that do not match the local application origin.

Description & Review Guide

• What are the major changes? Adds shared local request validation for .NET DevUI, applies it automatically to the standard backend routes, and adds equivalent checks to the Aspire DevUI aggregator. Also updates related documentation, tests, and the basic DevUI sample registration.
• What is the impact of these changes? Normal browser and command-line use on loopback continues to work. Applications using AllowRemoteAccess retain control of their own request policy.
• What do you want reviewers to focus on? The local Host and browser-origin checks, middleware route scope, and preservation of existing remote-access and bearer-token behavior.

Related Issue

Fixes #9570

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: Copilot assisted with implementation, tests, documentation, and this PR description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) - a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🟡 Changes recommended

A path-base protection bypass and compatibility failures involving aggregator origins and CORS preflights remain unresolved.

3 open issues

• PathBase bypasses protected-route validation · New
• CORS preflight blocked by bearer-token validation · New
• Dropped Host header causes false 403 through Aspire aggregator · New

What changed in this PR

Strengthens .NET DevUI local-request protection and updates Python security guidance.

Changes:

• Shares request validation across DevUI and standard backend routes.
• Adds Aspire aggregator checks and access-control tests.
• Updates security documentation and sample registration.

File	Description
python/​packages/​devui/​README.md	Warns about unauthenticated loopback access.
python/​packages/​devui/​dev.md	Adds local-testing security guidance.
python/​packages/​devui/​AGENTS.md	Documents unauthenticated-mode risks.
dotnet/​tests/​Microsoft.Agents.AI.DevUI.UnitTests/​DevUIAccessControlTests.cs	Tests backend access controls.
dotnet/​tests/​Aspire.Hosting.AgentFramework.DevUI.UnitTests/​DevUIAggregatorHostedServiceTests.cs	Tests aggregator request validation.
dotnet/​src/​Microsoft.Agents.AI.DevUI/​ServiceCollectionsExtensions.cs	Registers shared validation and middleware.
dotnet/​src/​Microsoft.Agents.AI.DevUI/​README.md	Explains access checks and scope.
dotnet/​src/​Microsoft.Agents.AI.DevUI/​DevUIRequestValidator.cs	Centralizes local-origin and token checks.
dotnet/​src/​Microsoft.Agents.AI.DevUI/​DevUIOptions.cs	Clarifies security option behavior.
dotnet/​src/​Microsoft.Agents.AI.DevUI/​DevUIAuthFilter.cs	Delegates to shared validation.
dotnet/​src/​Microsoft.Agents.AI.DevUI/​DevUIAccessControlStartupFilter.cs	Automatically installs access middleware.
dotnet/​src/​Microsoft.Agents.AI.DevUI/​DevUIAccessControlMiddleware.cs	Guards standard backend paths.
dotnet/​src/​Aspire.Hosting.AgentFramework.DevUI/​README.md	Documents aggregator protections.
dotnet/​src/​Aspire.Hosting.AgentFramework.DevUI/​DevUIAggregatorHostedService.cs	Adds Host and browser-origin validation.
dotnet/​samples/​02-agents/​DevUI/​README.md	Adds service registration guidance.
dotnet/​samples/​02-agents/​DevUI/​DevUI_Step01_BasicUsage/​README.md	Registers DevUI before app construction.
dotnet/​samples/​02-agents/​DevUI/​DevUI_Step01_BasicUsage/​Program.cs	Adds development-only DevUI registration.

_{Review effort: Balanced}

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): b146898b748e
Model: gpt-5.6-sol

Overview

The PR centralizes DevUI request validation, adds strict Host/origin checks, preserves token enforcement under remote-access mode, and covers the main direct-route and aggregator cases with focused tests. However, the automatic middleware runs before application path and proxy normalization, leaving two concrete ways to bypass the new controls. Applying the DevUI bearer token globally to separately authenticated OpenAI endpoints also creates an incompatible dual-bearer requirement.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
3 verified findings remained after source verification (2 high, 1 medium) across 3 files. Details are attached to the affected lines below.

Affected areas: dotnet/src/Microsoft.Agents.AI.DevUI/DevUIAccessControlMiddleware.cs, dotnet/src/Microsoft.Agents.AI.DevUI/DevUIAccessControlStartupFilter.cs, dotnet/src/Microsoft.Agents.AI.DevUI/ServiceCollectionsExtensions.cs