tsai/abp - abp - Gitea: Git with a cup of tea

47035 Commits

280 Branches

302 Tags

2.4 GiB

Tree: f51cfdcd0b

Commit Graph

Author	SHA1	Message	Date
maliming	30119d7d90	Refactor client_id cookie cleanup into an options extension - move OnRefreshingPrincipal logic to AbpOpenIddictSecurityStampValidatorOptionsExtensions - add unit tests for removal and callback composition order	2 months ago
gdlcf88	f9493d6dec	Prevent OpenIddict client_id from leaking into the interactive auth cookie When the cookie security stamp is refreshed during a /connect/authorize request, OpenIddictClaimsPrincipalContributor stamps the ambient request's client_id onto the principal that is written back to the interactive authentication cookie. From then on ICurrentClient.Id resolves to that client for every later cookie-authenticated request, corrupting audit-log client attribution. The contributor cannot tell whether the principal it contributes to is destined for a token (correct) or for the cookie being refreshed (wrong), so strip client_id at the only point where the cookie is actually re-written: the security-stamp OnRefreshingPrincipal callback. This never runs for token issuance, so the token path is untouched, and chaining the removal after the existing AbpSecurityStampValidatorCallback.UpdatePrincipal lets already-corrupted cookies self-heal on their next refresh. Adds Volo.Abp.OpenIddict.AspNetCore.Tests covering the removal and the callback composition order. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2 months ago

Author

SHA1

Message

Date

maliming

30119d7d90

Refactor client_id cookie cleanup into an options extension

- move OnRefreshingPrincipal logic to AbpOpenIddictSecurityStampValidatorOptionsExtensions

- add unit tests for removal and callback composition order

2 months ago

gdlcf88

f9493d6dec

Prevent OpenIddict client_id from leaking into the interactive auth cookie

When the cookie security stamp is refreshed during a /connect/authorize
request, OpenIddictClaimsPrincipalContributor stamps the ambient request's
client_id onto the principal that is written back to the interactive
authentication cookie. From then on ICurrentClient.Id resolves to that client
for every later cookie-authenticated request, corrupting audit-log client
attribution.

The contributor cannot tell whether the principal it contributes to is destined
for a token (correct) or for the cookie being refreshed (wrong), so strip
client_id at the only point where the cookie is actually re-written: the
security-stamp OnRefreshingPrincipal callback. This never runs for token
issuance, so the token path is untouched, and chaining the removal after the
existing AbpSecurityStampValidatorCallback.UpdatePrincipal lets already-corrupted
cookies self-heal on their next refresh.

Adds Volo.Abp.OpenIddict.AspNetCore.Tests covering the removal and the callback
composition order.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2 months ago

2 Commits (f51cfdcd0bcbb01944a3cb6ca7da7e12247ddeec)