JwtBearerHandler should check Authority & Issuer before trying to validate
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Is your feature request related to a problem? Please describe the problem.
Using multiple Identity Providers the BearerToken Validation code, validates all Idp's . This makes no sense and leads to false positives (e.g. hacking) having multiple exceptions on invalid tokens.
The problem is described here
https://oliviervaillancourt.com/posts/Fixing-IDX10501-MultipleAuthScheme
### Describe the solution you'd like
https://github.com/dotnet/aspnetcore/blob/v6.0.3/src/Security/Authentication/JwtBearer/src/JwtBearerHandler.cs
should unpack the token, check the issuer and authority
compare it. If the token being and it's issuer or authority do not match, do not raise an exception (or maybe just a warning).
If all validations failed but a token was given, *then* an exception should be raised (to improve security/logging)
### Additional context

There is the property ForwardDefaultSelector in JwtBearerOptions,
services.AddAuthentication(MobileAuthenticationDefaults.AuthenticationScheme)
which is related but in fact, this option seems unnecessary if token validation is a bit smarter using logic, described above.
To make this very explicit. If I have a JWT from Cognito, it makes no sense to validate this token against a validator for Azure. This also will lead to exensive downloading of public keys using JWTK.json (remotely)
Contributor guide
Assessment
This issue has not been assessed yet.