tsai/abp - abp - Gitea: Git with a cup of tea

Author	SHA1	Message	Date
maliming	e567df5598	Fix password grant two-factor authentication flow	3 weeks ago
maliming	d79fa71b41	Derive the OpenIddict opt-in URLs from the configured server endpoints	4 weeks ago
maliming	ab1daeeacd	Match opt-in URLs the same way as IgnoredUrls	4 weeks ago
maliming	f1e28e0ebc	Match the path base and normalize OpenIddict opt-in endpoint paths - Rename completedOnResponseStarting and fix response-start completion comments and docs	4 weeks ago
maliming	eaf1bf6fe3	Add opt-in options for completing the unit of work on response start - Enable globally via CompleteUnitOfWorkOnResponseStarting or per path via the Urls list - OpenIddict opts in its endpoints so token/session rows commit before the response	4 weeks ago
maliming	30119d7d90	Refactor client_id cookie cleanup into an options extension - move OnRefreshingPrincipal logic to AbpOpenIddictSecurityStampValidatorOptionsExtensions - add unit tests for removal and callback composition order	3 months ago
gdlcf88	f9493d6dec	Prevent OpenIddict client_id from leaking into the interactive auth cookie When the cookie security stamp is refreshed during a /connect/authorize request, OpenIddictClaimsPrincipalContributor stamps the ambient request's client_id onto the principal that is written back to the interactive authentication cookie. From then on ICurrentClient.Id resolves to that client for every later cookie-authenticated request, corrupting audit-log client attribution. The contributor cannot tell whether the principal it contributes to is destined for a token (correct) or for the cookie being refreshed (wrong), so strip client_id at the only point where the cookie is actually re-written: the security-stamp OnRefreshingPrincipal callback. This never runs for token issuance, so the token path is untouched, and chaining the removal after the existing AbpSecurityStampValidatorCallback.UpdatePrincipal lets already-corrupted cookies self-heal on their next refresh. Adds Volo.Abp.OpenIddict.AspNetCore.Tests covering the removal and the callback composition order. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	3 months ago