dotnet / dotnet/aspnetcore

Suggested improvements to RevalidatingServerAuthenticationStateProvider

Open
#49,176 5 comments 1 reaction 0 assignees View on GitHub
area-auth enhancement
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

I wish to have RevalidatingServerAuthenticationStateProvider improved to accomplish the following:

1. Revalidate immediately upon the start of a new circuit/session as the retained AuthenticationState that is used upon establishing the circuit is from a cookie (as I understand it) that may be from a session 5 seconds ago, but also 5 days ago.
2. When revalidating, update the user so it has the latest claims as those have just been read from the DB. You have it - use it.
3. Provide a call to revalidate immediately. If my code is updating the user account and gets a DbUpdateConcurrencyException for the update (due to that record not existing), then need to revalidate immediately.

### Describe the solution you'd like

Items 1 & 3 above can be solved by changing Task.Delay() to a ManualResetEvent that has a timeout of RevalidationInterval but can also be signaled. And move the location of that to the bottom of the `while (!cancellationToken.IsCancellationRequested)` loop so when the task is first started, it revalidates immediately.

Item 2 can be resolved easiest in RevalidatingIdentityAuthenticationStateProvider where it calls base.SetAuthenticationState() with the user it read in. That's easiest.

With that said, I think a better solution is for RevalidatingServerAuthenticationStateProvider.ValidateAuthenticationStateAsync to be defined as returning a `Task` where null means not valid and non-null is then set. However, that would break the API and as such is probably not a good idea.

### Additional context

**Update:** For item 2 above, I misunderstood something. This is not easy unless there's a call somewhere I am not aware of. It remains a very useful goal. But is there a way to get a ClaimsPrincipal rebuilt anew from what's in the Identity database? Or takes the existing AuthenticationState and updates the Claims and whatever else to create a ClaimsPrincipal that matches the database?

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with RevalidatingServerAuthenticationStateProvider and its ValidateAuthenticationStateAsync implementation, then inspect RevalidatingIdentityAuthenticationStateProvider and the current Task.Delay loop. Compare the requested immediate startup revalidation, callable revalidation, and refreshed claims behavior with the existing API. Done means the agreed behavior is implemented without an unresolved API design choice.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
authentication, backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.