Anti Forgery Claim Extractor: option to define claim name
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
## Background and Motivation
In a project that uses anti forgery features and 3rd party authentication provider, I found you can get anti forgery token validation failures in certain scenarios (auth provider does not use sub, nameidentifier or upn claims, whilst the iat claim value has changed).
If we could configure the name(s) of claims we want to use in the [DefaultClaimUidExtractor ](https://github.com/dotnet/aspnetcore/blob/main/src/Antiforgery/src/Internal/DefaultClaimUidExtractor.cs) class, we could fix the issue without having to change the configuration of the auth provider.
## Proposed API
```diff
services.AddAntiForgery(options =>
options.UidClaimNames = new string[] { "myUniqueUserClaim" }
);
```
## Alternative Designs
Tell the framework that there is an iat claim, then update [DefaultClaimUidExtractor](https://github.com/dotnet/aspnetcore/blob/ad2f29fcd2540e7c9e73709dcea91280d6f40273/src/Antiforgery/src/Internal/DefaultClaimUidExtractor.cs#L111) to not include the claim in the extraction.
```diff
services.AddAntiForgery(options =>
options.IatClaims = new string[] { "iat" }
);
```
## Risks
Developers could configure a claim that is not unique to the user.
Contributor guide
Assessment
This issue has not been assessed yet.