From a3fe301308175f0b29ceeda142ed07a51b7ef93e Mon Sep 17 00:00:00 2001
From: kjh2064 <kjh2064@gmail.com>
Date: Sun, 12 Jul 2026 13:14:20 +0900
Subject: [PATCH] security(web): secure Hangfire Dashboard with cookie
 authentication filter

---
 src/dotnet/QuantEngine.Web/Services/SchedulerService.cs | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/dotnet/QuantEngine.Web/Services/SchedulerService.cs b/src/dotnet/QuantEngine.Web/Services/SchedulerService.cs
index 82d94396..b7890ed1 100644
--- a/src/dotnet/QuantEngine.Web/Services/SchedulerService.cs
+++ b/src/dotnet/QuantEngine.Web/Services/SchedulerService.cs
@@ -328,8 +328,7 @@ public class HangfireAuthorizationFilter : IDashboardAuthorizationFilter
 {
     public bool Authorize(DashboardContext context)
     {
-        // TODO: Implement proper authorization check
-        // For now, allow all in development
-        return true;
+        var httpContext = context.GetHttpContext();
+        return httpContext.User.Identity?.IsAuthenticated == true;
     }
 }