Update the System.Net.Http integrations to always disable cookies support as a security measure

src/OpenIddict.Abstractions/OpenIddictResources.resx

@@ -1417,6 +1417,9 @@ To apply post-logout redirection responses, create a class implementing 'IOpenId
   <data name="ID0372" xml:space="preserve">
     <value>The System.Net.Http client cannot be resolved.</value>
   </data>
+  <data name="ID0373" xml:space="preserve">
+    <value>Only instances of type '{0}' can be used as primary HTTP handlers for the HTTP clients managed by OpenIddict.</value>
+  </data>
   <data name="ID2000" xml:space="preserve">
     <value>The security token is missing.</value>
   </data>

src/OpenIddict.Client.SystemNetHttp/OpenIddictClientSystemNetHttpConfiguration.cs

@@ -8,6 +8,7 @@ using System.ComponentModel;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Http;
 using Microsoft.Extensions.Options;
+using Polly;
 
 namespace OpenIddict.Client.SystemNetHttp;
 
@@ -75,8 +76,24 @@ public sealed class OpenIddictClientSystemNetHttpConfiguration : IConfigureOptio
 #else
             var options = _provider.GetRequiredService<IOptionsMonitor<OpenIddictClientSystemNetHttpOptions>>();
 #endif
-            var policy = options.CurrentValue.HttpErrorPolicy;
-            if (policy is not null)
+            if (builder.PrimaryHandler is not HttpClientHandler handler)
+            {
+                throw new InvalidOperationException(SR.GetResourceString(SR.ID0373));
+            }
+
+            // OpenIddict uses IHttpClientFactory to manage the creation of the HTTP clients and
+            // their underlying HTTP message handlers, that are cached for the specified duration
+            // and re-used to process multiple requests during that period. While remote APIs are
+            // typically not expected to return cookies, it is in practice a very frequent case,
+            // which poses a serious security issue when the cookies are shared across multiple
+            // requests (which is the case when the same message handler is cached and re-used).
+            //
+            // To avoid that, cookies support is explicitly disabled here, for security reasons.
+            handler.UseCookies = false;
+
+            // Unless the HTTP error policy was explicitly disabled in the options,
+            // add the HTTP handler responsible for replaying failed HTTP requests.
+            if (options.CurrentValue.HttpErrorPolicy is IAsyncPolicy<HttpResponseMessage> policy)
             {
                 builder.AdditionalHandlers.Add(new PolicyHttpMessageHandler(policy));
             }

src/OpenIddict.Client.WebIntegration/OpenIddictClientWebIntegrationConfiguration.cs

@@ -85,16 +85,14 @@ public sealed partial class OpenIddictClientWebIntegrationConfiguration : IConfi
                 var options = _provider.GetRequiredService<IOptionsMonitor<
                     OpenIddictClientWebIntegrationOptions.ProSantéConnect>>().CurrentValue;
 #endif
-                // If a client certificate was specified, alter the HTTP handler.
-                if (options.ClientCertificate is X509Certificate certificate)
+                if (builder.PrimaryHandler is not HttpClientHandler handler)
                 {
-                    // If the primary HTTP handler is not an instance of HttpClientHandler, replace it by
-                    // a new instance of HttpClientHandler as it required to attach the client certificate.
-                    if (builder.PrimaryHandler is not HttpClientHandler handler)
-                    {
-                        builder.PrimaryHandler = handler = new HttpClientHandler();
-                    }
+                    throw new InvalidOperationException(SR.GetResourceString(SR.ID0373));
+                }
 
+                // If a client certificate was specified, update the HTTP handler to use it.
+                if (options.ClientCertificate is X509Certificate certificate)
+                {
                     handler.ClientCertificates.Add(certificate);
                     handler.ClientCertificateOptions = ClientCertificateOption.Manual;
                 }

src/OpenIddict.Validation.SystemNetHttp/OpenIddictValidationSystemNetHttpConfiguration.cs

@@ -8,6 +8,7 @@ using System.ComponentModel;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Http;
 using Microsoft.Extensions.Options;
+using Polly;
 
 namespace OpenIddict.Validation.SystemNetHttp;
 
@@ -75,8 +76,24 @@ public sealed class OpenIddictValidationSystemNetHttpConfiguration : IConfigureO
 #else
             var options = _provider.GetRequiredService<IOptionsMonitor<OpenIddictValidationSystemNetHttpOptions>>();
 #endif
-            var policy = options.CurrentValue.HttpErrorPolicy;
-            if (policy is not null)
+            if (builder.PrimaryHandler is not HttpClientHandler handler)
+            {
+                throw new InvalidOperationException(SR.GetResourceString(SR.ID0373));
+            }
+
+            // OpenIddict uses IHttpClientFactory to manage the creation of the HTTP clients and
+            // their underlying HTTP message handlers, that are cached for the specified duration
+            // and re-used to process multiple requests during that period. While remote APIs are
+            // typically not expected to return cookies, it is in practice a very frequent case,
+            // which poses a serious security issue when the cookies are shared across multiple
+            // requests (which is the case when the same message handler is cached and re-used).
+            //
+            // To avoid that, cookies support is explicitly disabled here, for security reasons.
+            handler.UseCookies = false;
+
+            // Unless the HTTP error policy was explicitly disabled in the options,
+            // add the HTTP handler responsible for replaying failed HTTP requests.
+            if (options.CurrentValue.HttpErrorPolicy is IAsyncPolicy<HttpResponseMessage> policy)
             {
                 builder.AdditionalHandlers.Add(new PolicyHttpMessageHandler(policy));
             }