From 3bc72160a443fb5ce24189ad55d064a53b07e431 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?K=C3=A9vin=20Chalet?= Date: Wed, 13 Mar 2024 14:45:28 +0100 Subject: [PATCH] Consider user codes invalid when no client_id claim could be resolved from the AuthenticateResult --- .../Controllers/AuthorizationController.cs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sandbox/OpenIddict.Sandbox.AspNetCore.Server/Controllers/AuthorizationController.cs b/sandbox/OpenIddict.Sandbox.AspNetCore.Server/Controllers/AuthorizationController.cs index f483c2a1..56ee5b9d 100644 --- a/sandbox/OpenIddict.Sandbox.AspNetCore.Server/Controllers/AuthorizationController.cs +++ b/sandbox/OpenIddict.Sandbox.AspNetCore.Server/Controllers/AuthorizationController.cs @@ -328,7 +328,7 @@ public class AuthorizationController : Controller // Retrieve the claims principal associated with the user code. var result = await HttpContext.AuthenticateAsync(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme); - if (result.Succeeded) + if (result.Succeeded && !string.IsNullOrEmpty(result.Principal.GetClaim(Claims.ClientId))) { // Retrieve the application details from the database using the client_id stored in the principal. var application = await _applicationManager.FindByClientIdAsync(result.Principal.GetClaim(Claims.ClientId)) ?? @@ -361,7 +361,7 @@ public class AuthorizationController : Controller // Retrieve the claims principal associated with the user code. var result = await HttpContext.AuthenticateAsync(OpenIddictServerAspNetCoreDefaults.AuthenticationScheme); - if (result.Succeeded) + if (result.Succeeded && !string.IsNullOrEmpty(result.Principal.GetClaim(Claims.ClientId))) { // Create the claims-based identity that will be used by OpenIddict to generate tokens. var identity = new ClaimsIdentity(