dotnet / dotnet/aspnetcore

OpenIdConnectHandler to support async state data format operations

Open
#54,704 0 comments 0 reactions 0 assignees View on GitHub
area-auth enhancement
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

Currently the `OpenIdConnectHandler` class uses `Options.StateDataFormat` to protect/unprotect OAuth state, and the interface `ISecureDataFormat` does not define any async methods, so the data protection operation here is always synchronous.
This creates a problem for the following use case:
Putting the entire state in `state` query param could make the URL too large, a common solution to this is putting the actual state in storage and only set an encrypted key in state param which can be used later to retrieve the state.
Obviously the storage operations will need to be async, but the way that `OpenIdConnectHandler` handles this today, like I mentioned earlier, makes it impossible to do state data protection synchronously. The only option we have is to implement `ISecureDataFormat`, call async storage methods and wait for Task results synchronously. But this sort of "sync over async" behavior should best be avoided if possible.

### Describe the solution you'd like

One possible solution:

1. define a new interface `IAsyncSecureDataFormat`, similar to `ISecureDataFormat` except the methods are all async
2. add a new property in `OpenIdConnectOptions`: `IAsyncSecureDataFormat AsyncStateDataFormat { get; set; }`
3. in `OpenIdConnectHandler`, use the `Options.AsyncStateDataFormat` if defined, otherwise fallback to `Options.StateDataFormat`

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.