Conversation
Comment on lines
+92
to
+96
| catch | ||
| { | ||
| // no errors during authentication should throw an exception | ||
| // specifically, attempting to validate an invalid JWT token will result in an exception, which may be logged or simply ignored to not generate an inordinate amount of logs without purpose | ||
| } |
Check notice
Code scanning / CodeQL
Generic catch clause
Comment on lines
+102
to
+119
| foreach (var validator in options.SecurityTokenValidators) | ||
| { | ||
| if (validator.CanReadToken(token)) | ||
| { | ||
| try | ||
| { | ||
| var principal = validator.ValidateToken(token, tokenValidationParameters, out _); | ||
| // set the ClaimsPrincipal for the HttpContext; authentication will take place against this object | ||
| connection.HttpContext.User = principal; | ||
| return; | ||
| } | ||
| catch | ||
| { | ||
| // no errors during authentication should throw an exception | ||
| // specifically, attempting to validate an invalid JWT token will result in an exception, which may be logged or simply ignored to not generate an inordinate amount of logs without purpose | ||
| } | ||
| } | ||
| } |
Check notice
Code scanning / CodeQL
Missed opportunity to use Where
Comment on lines
+113
to
+117
| catch | ||
| { | ||
| // no errors during authentication should throw an exception | ||
| // specifically, attempting to validate an invalid JWT token will result in an exception, which may be logged or simply ignored to not generate an inordinate amount of logs without purpose | ||
| } |
Check notice
Code scanning / CodeQL
Generic catch clause
gao-artur
approved these changes
Nov 21, 2024
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The previous sample handler decoded the parsed JWT token directly using
JwtSecurityTokenHandler. This works fine when theTokenValidationParameterswere all configured (including the security keys). However, when using OIDC, theTokenValidationParametersshould be generated from theConfigurationManager, as it needs to download the keys from the OIDC endpoint before theTokenValidationParameterinstance contains the keys. The revised code now is a copy (without much of the event and error handling) of theJwtBearerHandlerlogic, so that validation will work similarly to however it is configured within ASP.NET Core. Events are still not implemented at this time.Keep in mind that while this code can be used as a guide for to how to write authorization logic for subscriptions, it is the user's responsibility to ensure that their endpoint is secure. Perhaps in the future we may publish this code in a NuGet package, but for now it is still sample code.