Suggested improvements to RevalidatingServerAuthenticationStateProvider
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Is your feature request related to a problem? Please describe the problem.
I wish to have RevalidatingServerAuthenticationStateProvider improved to accomplish the following:
1. Revalidate immediately upon the start of a new circuit/session as the retained AuthenticationState that is used upon establishing the circuit is from a cookie (as I understand it) that may be from a session 5 seconds ago, but also 5 days ago.
2. When revalidating, update the user so it has the latest claims as those have just been read from the DB. You have it - use it.
3. Provide a call to revalidate immediately. If my code is updating the user account and gets a DbUpdateConcurrencyException for the update (due to that record not existing), then need to revalidate immediately.
### Describe the solution you'd like
Items 1 & 3 above can be solved by changing Task.Delay() to a ManualResetEvent that has a timeout of RevalidationInterval but can also be signaled. And move the location of that to the bottom of the `while (!cancellationToken.IsCancellationRequested)` loop so when the task is first started, it revalidates immediately.
Item 2 can be resolved easiest in RevalidatingIdentityAuthenticationStateProvider where it calls base.SetAuthenticationState() with the user it read in. That's easiest.
With that said, I think a better solution is for RevalidatingServerAuthenticationStateProvider.ValidateAuthenticationStateAsync to be defined as returning a `Task` where null means not valid and non-null is then set. However, that would break the API and as such is probably not a good idea.
### Additional context
**Update:** For item 2 above, I misunderstood something. This is not easy unless there's a call somewhere I am not aware of. It remains a very useful goal. But is there a way to get a ClaimsPrincipal rebuilt anew from what's in the Identity database? Or takes the existing AuthenticationState and updates the Claims and whatever else to create a ClaimsPrincipal that matches the database?
_No response_
Contributor guide
Research direction
Start with RevalidatingServerAuthenticationStateProvider and its ValidateAuthenticationStateAsync implementation, then inspect RevalidatingIdentityAuthenticationStateProvider and the current Task.Delay loop. Compare the requested immediate startup revalidation, callable revalidation, and refreshed claims behavior with the existing API. Done means the agreed behavior is implemented without an unresolved API design choice.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- authentication, backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 28/100