dotnet / dotnet/aspnetcore

JwtBearerHandler should check Authority & Issuer before trying to validate

Open
#44,724 3 comments 2 reactions 0 assignees View on GitHub
area-auth enhancement
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

Using multiple Identity Providers the BearerToken Validation code, validates all Idp's . This makes no sense and leads to false positives (e.g. hacking) having multiple exceptions on invalid tokens.

The problem is described here
https://oliviervaillancourt.com/posts/Fixing-IDX10501-MultipleAuthScheme

### Describe the solution you'd like

https://github.com/dotnet/aspnetcore/blob/v6.0.3/src/Security/Authentication/JwtBearer/src/JwtBearerHandler.cs
should unpack the token, check the issuer and authority
compare it. If the token being and it's issuer or authority do not match, do not raise an exception (or maybe just a warning).

If all validations failed but a token was given, *then* an exception should be raised (to improve security/logging)

### Additional context

![afbeelding](https://user-images.githubusercontent.com/3471239/197710739-372ac63f-9f3b-4c45-8c52-6446ac3c1e4f.png)

There is the property ForwardDefaultSelector in JwtBearerOptions,
services.AddAuthentication(MobileAuthenticationDefaults.AuthenticationScheme)

which is related but in fact, this option seems unnecessary if token validation is a bit smarter using logic, described above.
To make this very explicit. If I have a JWT from Cognito, it makes no sense to validate this token against a validator for Azure. This also will lead to exensive downloading of public keys using JWTK.json (remotely)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.