KeyRingProvider uses 24h refresh period even with expired keys and disabled key auto-generation
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 290
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Describe the bug
When `KeyRingProvider` uses an expired key with `AutoGenerateKeys = false`, it schedules the next refresh for up to 24 hours in the future: https://github.com/dotnet/aspnetcore/blob/0230498dfccaef6f782a5e37c60ea505081b72bf/src/DataProtection/DataProtection/src/KeyManagement/KeyRingProvider.cs#L187-L198
This creates a problem in multi-application scenarios where:
1. App A generates keys
2. App B has `AutoGenerateKeys = false` and relies on App A for new keys, but starts few minutes earlier than App A
3. When App B's key expires, it waits up to 24h before checking for new keys from App A
Since App B explicitly disabled auto-generation, it depends on other apps for new keys and should check for them more frequently when using expired keys (e.g., every 5 minutes).
**Suggested fix:**
Use a shorter refresh period when `defaultKey.ExpirationDate <= now && !_keyManagementOptions.AutoGenerateKeys`
Contributor guide
Assessment
This issue has not been assessed yet.