dotnet / dotnet/aspnetcore

Anti Forgery Claim Extractor: option to define claim name

Open
#46,137 6 comments 1 reaction 0 assignees View on GitHub
api-suggestion area-auth
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

## Background and Motivation
In a project that uses anti forgery features and 3rd party authentication provider, I found you can get anti forgery token validation failures in certain scenarios (auth provider does not use sub, nameidentifier or upn claims, whilst the iat claim value has changed).

If we could configure the name(s) of claims we want to use in the [DefaultClaimUidExtractor ](https://github.com/dotnet/aspnetcore/blob/main/src/Antiforgery/src/Internal/DefaultClaimUidExtractor.cs) class, we could fix the issue without having to change the configuration of the auth provider.

## Proposed API

```diff

services.AddAntiForgery(options =>
options.UidClaimNames = new string[] { "myUniqueUserClaim" }
);

```

## Alternative Designs
Tell the framework that there is an iat claim, then update [DefaultClaimUidExtractor](https://github.com/dotnet/aspnetcore/blob/ad2f29fcd2540e7c9e73709dcea91280d6f40273/src/Antiforgery/src/Internal/DefaultClaimUidExtractor.cs#L111) to not include the claim in the extraction.
```diff

services.AddAntiForgery(options =>
options.IatClaims = new string[] { "iat" }
);

```

## Risks
Developers could configure a claim that is not unique to the user.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.