Allow Rfc6238AuthenticationService time-step size and time-step window to be configurable
Open
affected-very-few
area-identity
enhancement
severity-major
triaged
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 290
Description
Hello,
I have some security concerns regarding the default value of 3 minutes for time-step. It seems very long.
https://github.com/dotnet/aspnetcore/blob/ce16ff0a51a74811674228835696e5cc78494fd7/src/Identity/Extensions.Core/src/Rfc6238AuthenticationService.cs#L14
In addition allowing variance of two steps ahead and behind make the window even larger.
https://github.com/dotnet/aspnetcore/blob/ce16ff0a51a74811674228835696e5cc78494fd7/src/Identity/Extensions.Core/src/Rfc6238AuthenticationService.cs#L101-L113
[RFC](https://tools.ietf.org/html/rfc6238) recommends a time-step size of 30 seconds and a time-step window of less than 10 minutes.
Contributor guide
Assessment
This issue has not been assessed yet.