[James Newton-King (JamesNK)]

Description

The standalone Dashboard can fail to initialize behind IIS ARR when Blazor negotiates WebSocket compression. Users currently have to strip the WebSocket compression request header at the reverse proxy.

Add Dashboard:Frontend:DisableWebSocketCompression so users can disable Blazor WebSocket compression through JSON configuration or an environment variable instead. The option defaults to false, preserving the existing compression-enabled behavior. HTTP response compression for static assets is unaffected.

The option is bound through the existing Dashboard configuration infrastructure and passed to Blazor's AddInteractiveServerRenderMode options. This also documents the setting and adds JSON-binding tests for omitted, false, and true values. No new dependencies are required.

Fixes #20598

User-facing usage

Set the environment variable:

DASHBOARD__FRONTEND__DISABLEWEBSOCKETCOMPRESSION=true

Or provide JSON configuration:

{
  "Dashboard": {
    "Frontend": {
      "DisableWebSocketCompression": true
    }
  }
}

Restart the Dashboard after changing this setting. Disabling compression increases WebSocket bandwidth usage.

Validation

• .\restore.cmd - passed.
• The following command passed: 63 tests succeeded, with no failures or skipped tests.

$env:MSBUILDTERMINALLOGGER = 'false'
dotnet test --project tests\Aspire.Dashboard.Tests\Aspire.Dashboard.Tests.csproj --no-launch-profile -p:InstallBrowsersForPlaywright=false -- --filter-class "*.DashboardOptionsTests" --filter-class "*.BlazorWebSocketOriginTests" --filter-class "*.BrowserSecurityHeadersMiddlewareTests" --filter-not-trait "quarantined=true" --filter-not-trait "outerloop=true"

• git --no-pager diff --check - passed.
• IIS ARR interoperability was not tested locally. The committed tests cover configuration binding and existing WebSocket origin and browser security-header behavior.

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 20633

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 20633"

[github-actions]

Tests selector

54 / 97 PR test projects · 5 PR jobs, from 4 changed files.

Selected PR test projects (54 / 97)

Aspire.Cli.EndToEnd.Tests, Aspire.Cli.Tests, Aspire.Dashboard.Components.Tests, Aspire.Dashboard.Tests, Aspire.Hosting.Analyzers.Tests, Aspire.Hosting.Azure.Kubernetes.Tests, Aspire.Hosting.Azure.Kusto.Tests, Aspire.Hosting.Azure.Provisioning.Tests, Aspire.Hosting.Azure.Tests, Aspire.Hosting.Blazor.Tests, Aspire.Hosting.Browsers.Tests, Aspire.Hosting.CodeGeneration.Go.Tests, Aspire.Hosting.CodeGeneration.Java.Tests, Aspire.Hosting.CodeGeneration.Python.Tests, Aspire.Hosting.CodeGeneration.Rust.Tests, Aspire.Hosting.CodeGeneration.TypeScript.Tests, Aspire.Hosting.Containers.Tests, Aspire.Hosting.DevTunnels.Tests, Aspire.Hosting.Docker.Tests, Aspire.Hosting.Dotnet.Tests, Aspire.Hosting.DotnetTool.Tests, Aspire.Hosting.EntityFrameworkCore.Tests, Aspire.Hosting.Foundry.Tests, Aspire.Hosting.Garnet.Tests, Aspire.Hosting.Go.Tests, Aspire.Hosting.Java.Tests, Aspire.Hosting.JavaScript.Tests, Aspire.Hosting.Kafka.Tests, Aspire.Hosting.Keycloak.Tests, Aspire.Hosting.Kubernetes.Tests, Aspire.Hosting.Maui.Tests, Aspire.Hosting.Milvus.Tests, Aspire.Hosting.MongoDB.Tests, Aspire.Hosting.MySql.Tests, Aspire.Hosting.Nats.Tests, Aspire.Hosting.OpenAI.Tests, Aspire.Hosting.Oracle.Tests, Aspire.Hosting.Orleans.Tests, Aspire.Hosting.PostgreSQL.Tests, Aspire.Hosting.Python.Tests, Aspire.Hosting.Qdrant.Tests, Aspire.Hosting.RabbitMQ.Tests, Aspire.Hosting.Radius.Tests, Aspire.Hosting.Redis.Tests, Aspire.Hosting.RemoteHost.Tests, Aspire.Hosting.Rust.Tests, Aspire.Hosting.Seq.Tests, Aspire.Hosting.SqlServer.Tests, Aspire.Hosting.Testing.Tests, Aspire.Hosting.Tests, Aspire.Hosting.Valkey.Tests, Aspire.Hosting.Yarp.Tests, Aspire.Playground.Tests, Aspire.Templates.Tests

Selected PR jobs (5)

cli-starter-validation, extension-e2e, native-dashboard-validation, polyglot, typescript-api-compat

---

How these were chosen — grouped by what changed

⚠️ 43 of the 54 selected test projects come from a single change — src/Shared/DashboardConfigNames.cs.

🔧 src/Shared/DashboardConfigNames.cs (changed source)
→ 43 via the project graph

show 43

Aspire.Cli.Tests, Aspire.Hosting.Analyzers.Tests (2 hops), Aspire.Hosting.Azure.Kubernetes.Tests (2 hops), Aspire.Hosting.Azure.Kusto.Tests (2 hops), Aspire.Hosting.Azure.Provisioning.Tests (3 hops), Aspire.Hosting.Azure.Tests, Aspire.Hosting.Browsers.Tests (2 hops), Aspire.Hosting.CodeGeneration.Go.Tests, Aspire.Hosting.CodeGeneration.Java.Tests, Aspire.Hosting.CodeGeneration.Python.Tests, Aspire.Hosting.CodeGeneration.Rust.Tests, Aspire.Hosting.CodeGeneration.TypeScript.Tests, Aspire.Hosting.Containers.Tests (2 hops), Aspire.Hosting.DevTunnels.Tests (2 hops), Aspire.Hosting.Docker.Tests (2 hops), Aspire.Hosting.EntityFrameworkCore.Tests (2 hops), Aspire.Hosting.Foundry.Tests (2 hops), Aspire.Hosting.Garnet.Tests (2 hops), Aspire.Hosting.Go.Tests (2 hops), Aspire.Hosting.Java.Tests (2 hops), Aspire.Hosting.Kafka.Tests (2 hops), Aspire.Hosting.Keycloak.Tests (2 hops), Aspire.Hosting.Kubernetes.Tests (2 hops), Aspire.Hosting.Maui.Tests, Aspire.Hosting.Milvus.Tests (2 hops), Aspire.Hosting.MongoDB.Tests (2 hops), Aspire.Hosting.MySql.Tests (2 hops), Aspire.Hosting.Nats.Tests (2 hops), Aspire.Hosting.OpenAI.Tests (2 hops), Aspire.Hosting.Oracle.Tests (2 hops), Aspire.Hosting.Orleans.Tests (2 hops), Aspire.Hosting.PostgreSQL.Tests (2 hops), Aspire.Hosting.Python.Tests (2 hops), Aspire.Hosting.Qdrant.Tests (2 hops), Aspire.Hosting.RabbitMQ.Tests (2 hops), Aspire.Hosting.Redis.Tests (2 hops), Aspire.Hosting.RemoteHost.Tests, Aspire.Hosting.Rust.Tests (2 hops), Aspire.Hosting.Seq.Tests (2 hops), Aspire.Hosting.SqlServer.Tests (2 hops), Aspire.Hosting.Valkey.Tests (2 hops), Aspire.Hosting.Yarp.Tests (2 hops), Aspire.Playground.Tests

🔧 src/Aspire.Dashboard/Configuration/DashboardOptions.cs (changed source)
→ 8 via the project graph: Aspire.Dashboard.Components.Tests, Aspire.Hosting.Blazor.Tests (2 hops), Aspire.Hosting.Dotnet.Tests (2 hops), Aspire.Hosting.DotnetTool.Tests (2 hops), Aspire.Hosting.JavaScript.Tests, Aspire.Hosting.Radius.Tests (2 hops), Aspire.Hosting.Testing.Tests, Aspire.Hosting.Tests

📦 affected project Aspire.Cli
→ 1 test: Aspire.Cli.EndToEnd.Tests

📦 affected project Aspire.Dashboard
→ 1 test: Aspire.Templates.Tests

🧪 tests/Aspire.Dashboard.Tests/DashboardOptionsTests.cs (changed test)
→ 1 directly: Aspire.Dashboard.Tests

Job reasons

Job	Triggered by
cli-starter-validation	affected project Aspire.Cli
extension-e2e	• src/Aspire.Dashboard/Configuration/DashboardOptions.cs, src/Aspire.Dashboard/DashboardWebApplication.cs • affected project Aspire.Dashboard
native-dashboard-validation	affected project Aspire.Dashboard
polyglot	• affected project Aspire.Hosting.Azure.AppService • affected project Aspire.Hosting.Azure.Provisioning.AppService
typescript-api-compat	affected project Aspire.Hosting.Azure.AppService

---

Selection computed for commit a986c18.

[Copilot]

Copilot review overview

🟡 Changes recommended

Disabling compression removes existing frame-ancestor protection, and the endpoint behavior lacks regression coverage.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Preserve frame-ancestors CSP when disabling WebSocket compression · New
• Add regression test for WebSocket compression negotiation · New

What changed in this PR

Adds a dashboard setting to disable Blazor WebSocket compression for incompatible reverse proxies.

Changes:

• Binds and applies DisableWebSocketCompression.
• Documents the setting and environment-variable usage.
• Adds JSON configuration-binding tests.

File	Description
src/​Aspire.Dashboard/​Configuration/​DashboardOptions.cs	Defines the frontend option.
src/​Aspire.Dashboard/​DashboardWebApplication.cs	Applies it to Blazor.
src/​Aspire.Dashboard/​README.md	Documents the setting.
src/​Shared/​DashboardConfigNames.cs	Defines configuration names.
tests/​Aspire.Dashboard.Tests/​DashboardOptionsTests.cs	Tests JSON binding.

[aspire-repo-bot]

Pull request created: #1820

Generated by PR Documentation Check · copilot · auto · 42.9 AIC · ⌖ 11.8 AIC · ⊞ 20.3K

[aspire-repo-bot]

📝 Documentation has been drafted in microsoft/aspire.dev#1820 targeting release/17.0.

Documented the new Dashboard:Frontend:DisableWebSocketCompression setting (default false), triggered by signals pr_body_has_user_facing_section and pr_body_has_cli_flag_mention — the source PR body's "User-facing usage" section shows the env-var form DASHBOARD__FRONTEND__DISABLEWEBSOCKETCOMPRESSION=true and JSON config form. Added a row to the Frontend options table in src/frontend/src/content/docs/dashboard/configuration.mdx, matching the wording already used for sibling options (PublicUrl, MaxConsoleLogCount) and citing the identifiers verbatim from src/Aspire.Dashboard/Configuration/DashboardOptions.cs and src/Shared/DashboardConfigNames.cs.

Note

This draft PR needs human review before merging.