Backport the ApplyAuthorizationResponse/ApplyLogoutResponse fix to OpenIddict 1.x

src/OpenIddict.Server/Internal/OpenIddictServerProvider.Authentication.cs

@@ -503,8 +503,11 @@ namespace OpenIddict.Server
         {
             var options = (OpenIddictServerOptions) context.Options;
 
+            // Note: as this stage, the request associated with the context may be null if an error
+            // occurred very early in the pipeline (e.g an invalid HTTP verb was used by the caller).
+
             // Remove the authorization request from the distributed cache.
-            if (options.EnableRequestCaching && !string.IsNullOrEmpty(context.Request.RequestId))
+            if (options.EnableRequestCaching && !string.IsNullOrEmpty(context.Request?.RequestId))
             {
                 // Note: the cache key is always prefixed with a specific marker
                 // to avoid collisions with the other types of cached requests.

src/OpenIddict.Server/Internal/OpenIddictServerProvider.Session.cs

@@ -220,8 +220,11 @@ namespace OpenIddict.Server
         {
             var options = (OpenIddictServerOptions) context.Options;
 
+            // Note: as this stage, the request associated with the context may be null if an error
+            // occurred very early in the pipeline (e.g an invalid HTTP verb was used by the caller).
+
             // Remove the logout request from the distributed cache.
-            if (options.EnableRequestCaching && !string.IsNullOrEmpty(context.Request.RequestId))
+            if (options.EnableRequestCaching && !string.IsNullOrEmpty(context.Request?.RequestId))
             {
                 // Note: the cache key is always prefixed with a specific marker
                 // to avoid collisions with the other types of cached requests.

test/OpenIddict.Server.Tests/Internal/OpenIddictServerProviderTests.Authentication.cs

@@ -6,12 +6,12 @@
 
 using System.Collections.Immutable;
 using System.IO;
+using System.Net.Http;
 using System.Security.Cryptography;
 using System.Threading;
 using System.Threading.Tasks;
 using AspNet.Security.OpenIdConnect.Client;
 using AspNet.Security.OpenIdConnect.Primitives;
-using Microsoft.AspNetCore.Builder;
 using Microsoft.Extensions.Caching.Distributed;
 using Microsoft.Extensions.DependencyInjection;
 using Moq;
@@ -978,6 +978,29 @@ namespace OpenIddict.Server.Tests
                 "b2ee7815-5579-4ff7-86b0-ba671b939d96"), Times.Once());
         }
 
+        [Fact]
+        public async Task ApplyAuthorizationResponse_SupportsNullRequests()
+        {
+            // Note: when an invalid HTTP verb is used, the OpenID Connect server handler refuses to extract the request
+            // and immediately returns an error. In this specific case, ApplyAuthorizationResponseContext.Request is null
+            // and this test ensures ApplyAuthorizationResponse can safely handle cases where the request is unavailable.
+
+            // Arrange
+            var server = CreateAuthorizationServer(builder =>
+            {
+                builder.EnableRequestCaching();
+            });
+
+            var client = new OpenIdConnectClient(server.CreateClient());
+
+            // Act
+            var response = await client.SendAsync(HttpMethod.Put, AuthorizationEndpoint, new OpenIdConnectRequest());
+
+            // Assert
+            Assert.Equal(OpenIdConnectConstants.Errors.InvalidRequest, response.Error);
+            Assert.Equal("The specified HTTP method is not valid.", response.ErrorDescription);
+        }
+
         [Fact]
         public async Task ApplyAuthorizationResponse_ErroredRequestIsNotHandledLocallyWhenStatusCodeMiddlewareIsEnabled()
         {

test/OpenIddict.Server.Tests/Internal/OpenIddictServerProviderTests.Session.cs

@@ -5,12 +5,12 @@
  */
 
 using System.Collections.Immutable;
+using System.Net.Http;
 using System.Security.Cryptography;
 using System.Threading;
 using System.Threading.Tasks;
 using AspNet.Security.OpenIdConnect.Client;
 using AspNet.Security.OpenIdConnect.Primitives;
-using Microsoft.AspNetCore.Builder;
 using Microsoft.Extensions.Caching.Distributed;
 using Microsoft.Extensions.DependencyInjection;
 using Moq;
@@ -187,6 +187,29 @@ namespace OpenIddict.Server.Tests
             Assert.Equal("af0ifjsldkj", response.State);
         }
 
+        [Fact]
+        public async Task ApplyLogoutResponse_SupportsNullRequests()
+        {
+            // Note: when an invalid HTTP verb is used, the OpenID Connect server handler refuses to extract the request
+            // and immediately returns an error. In this specific case, ApplyLogoutResponseContext.Request is null
+            // and this test ensures ApplyLogoutResponse can safely handle cases where the request is unavailable.
+
+            // Arrange
+            var server = CreateAuthorizationServer(builder =>
+            {
+                builder.EnableRequestCaching();
+            });
+
+            var client = new OpenIdConnectClient(server.CreateClient());
+
+            // Act
+            var response = await client.SendAsync(HttpMethod.Put, LogoutEndpoint, new OpenIdConnectRequest());
+
+            // Assert
+            Assert.Equal(OpenIdConnectConstants.Errors.InvalidRequest, response.Error);
+            Assert.Equal("The specified HTTP method is not valid.", response.ErrorDescription);
+        }
+
         [Fact]
         public async Task ApplyLogoutResponse_ErroredRequestIsNotHandledLocallyWhenStatusCodeMiddlewareIsEnabled()
         {