You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/core/compatibility/aspnet-core/8.0/securitytoken-events.md
+5-5Lines changed: 5 additions & 5 deletions
Original file line number
Diff line number
Diff line change
@@ -5,21 +5,21 @@ ms.date: 07/31/2023
5
5
---
6
6
# Security token events return a JsonWebToken
7
7
8
-
The <xref:Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerEvents>, <xref:Microsoft.AspNetCore.Authentication.WsFederation.WsFederationEvents>, and <xref:Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectEvents> events are authentication events fired respectively by the [JwtBearer](xref:Microsoft.AspNetCore.Authentication.JwtBearer), [WsFederation](xref:Microsoft.AspNetCore.Authentication.WsFederation), and [OpenIdConnect](xref:Microsoft.AspNetCore.Authentication.OpenIdConnect) authentication handlers. For example, the <xref:Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerEvents.OnTokenValidated> event is fired when a security token is validated. These events are fired with a context (for example, <xref:Microsoft.AspNetCore.Authentication.JwtBearer.TokenValidatedContext>) that exposes a <xref:Microsoft.AspNetCore.Authentication.JwtBearer.TokenValidatedContext.SecurityToken?displayProperty=nameWithType> property of abstract type <xref:System.IdentityModel.Tokens.SecurityToken>. The default real implementation of <xref:Microsoft.AspNetCore.Authentication.JwtBearer.TokenValidatedContext.SecurityToken?displayProperty=nameWithType> changed from <xref:System.IdentityModel.Tokens.Jwt.JwtSecurityToken> to <xref:Microsoft.IdentityModel.JsonWebTokens.JsonWebToken>.
8
+
The <xref:Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerEvents>, <xref:Microsoft.AspNetCore.Authentication.WsFederation.WsFederationEvents>, and <xref:Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectEvents> events are authentication events fired respectively by the [JwtBearer](xref:Microsoft.AspNetCore.Authentication.JwtBearer), [WsFederation](xref:Microsoft.AspNetCore.Authentication.WsFederation), and [OpenIdConnect](xref:Microsoft.AspNetCore.Authentication.OpenIdConnect) authentication handlers. For example, the <xref:Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerEvents.OnTokenValidated> event is fired when a security token is validated. These events are fired with a context (for example, <xref:Microsoft.AspNetCore.Authentication.JwtBearer.TokenValidatedContext>) that exposes a <xref:Microsoft.AspNetCore.Authentication.JwtBearer.TokenValidatedContext.SecurityToken?displayProperty=nameWithType> property of abstract type <xref:System.IdentityModel.Tokens.SecurityToken>. The default real implementation of <xref:Microsoft.AspNetCore.Authentication.JwtBearer.TokenValidatedContext.SecurityToken?displayProperty=nameWithType> changed from `System.IdentityModel.Tokens.Jwt.JwtSecurityToken` to <xref:Microsoft.IdentityModel.JsonWebTokens.JsonWebToken>.
9
9
10
10
## Version introduced
11
11
12
12
ASP.NET Core 8.0 Preview 7
13
13
14
14
## Previous behavior
15
15
16
-
Previously, the affected `SecurityToken` properties were implemented by <xref:System.IdentityModel.Tokens.Jwt.JwtSecurityToken>, which derives from <xref:System.IdentityModel.Tokens.SecurityToken>. <xref:System.IdentityModel.Tokens.Jwt.JwtSecurityToken> is the previous generation of JSON Web Token (JWT) implementation. The <xref:System.IdentityModel.Tokens.Jwt.JwtSecurityToken> tokens were produced by <xref:Microsoft.AspNetCore.Builder.JwtBearerOptions.SecurityTokenValidators>.
16
+
Previously, the affected `SecurityToken` properties were implemented by `System.IdentityModel.Tokens.Jwt.JwtSecurityToken`, which derives from <xref:System.IdentityModel.Tokens.SecurityToken>. `JwtSecurityToken` is the previous generation of JSON Web Token (JWT) implementation. The `JwtSecurityToken` tokens were produced by <xref:Microsoft.AspNetCore.Builder.JwtBearerOptions.SecurityTokenValidators>.
17
17
18
-
In addition, the <xref:System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.DefaultInboundClaimTypeMap?displayProperty=nameWithType> field provided the default claim type mapping for inbound claims.
18
+
In addition, the `JwtSecurityTokenHandler.DefaultInboundClaimTypeMap` field provided the default claim type mapping for inbound claims.
19
19
20
20
## New behavior
21
21
22
-
Starting in ASP.NET Core 8.0, the <xref:Microsoft.IdentityModel.JsonWebTokens> class, which also derives from <xref:System.IdentityModel.Tokens.SecurityToken>, implements the `SecurityToken` properties, by default. <xref:Microsoft.IdentityModel.JsonWebTokens> tokens are produced by more optimized <xref:Microsoft.IdentityModel.Tokens.TokenHandler> handlers.
22
+
Starting in ASP.NET Core 8.0, the <xref:Microsoft.IdentityModel.JsonWebTokens> class, which also derives from <xref:System.IdentityModel.Tokens.SecurityToken>, implements the `SecurityToken` properties, by default. <xref:Microsoft.IdentityModel.JsonWebTokens> tokens are produced by more optimized `TokenHandler` handlers.
23
23
24
24
In addition, the <xref:Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenHandler.DefaultInboundClaimTypeMap?displayProperty=nameWithType> field provides the default claim type mapping for inbound claims.
25
25
@@ -37,7 +37,7 @@ This change was made because <xref:Microsoft.IdentityModel.JsonWebTokens.JsonWeb
37
37
38
38
## Recommended action
39
39
40
-
For most users, this change shouldn't be a problem as the type of the properties ([SecurityToken](xref:Microsoft.IdentityModel.Tokens.SecurityToken)) hasn't changed, and you weren't supposed to look at the real type.
40
+
For most users, this change shouldn't be a problem as the type of the properties (`SecurityToken`) hasn't changed, and you weren't supposed to look at the real type.
41
41
42
42
However, if you were down-casting one of the affected `SecurityToken` properties to `JwtSecurityToken` (for example, to get the claims), you have two options:
|<xref:System.IO.Stream.ReadAsync(System.Byte[],System.Int32,System.Int32)>|<xref:System.IO.Stream.ReadAsync(System.Memory{System.Byte},System.Threading.CancellationToken)> with `CancellationToken` set to `default` in C#, or `Nothing` in Visual Basic.|
Copy file name to clipboardExpand all lines: docs/fundamentals/code-analysis/quality-rules/ca5404.md
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -18,7 +18,7 @@ f1_keywords:
18
18
19
19
## Cause
20
20
21
-
Setting <xref:Microsoft.IdentityModel.Tokens.TokenValidationParameters> properties `RequireExpirationTime`, `ValidateAudience`, `ValidateIssuer`, or `ValidateLifetime` to `false`.
21
+
Setting the `Microsoft.IdentityModel.Tokens.TokenValidationParameters` properties `RequireExpirationTime`, `ValidateAudience`, `ValidateIssuer`, or `ValidateLifetime` to `false`.
22
22
23
23
## Rule description
24
24
@@ -28,7 +28,7 @@ More details about best practices for token validation can be found on the [libr
28
28
29
29
## How to fix violations
30
30
31
-
Set <xref:Microsoft.IdentityModel.Tokens.TokenValidationParameters> properties `RequireExpirationTime`, `ValidateAudience`, `ValidateIssuer`, or`ValidateLifetime` to `true`. Or, remove the assignment to `false` because the default value is `true`.
31
+
Set the `Microsoft.IdentityModel.Tokens.TokenValidationParameters` properties `RequireExpirationTime`, `ValidateAudience`, `ValidateIssuer`, and`ValidateLifetime` to `true`. Or, remove the assignment to `false` because the default value is `true`.
Copy file name to clipboardExpand all lines: docs/fundamentals/code-analysis/quality-rules/ca5405.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -18,7 +18,7 @@ f1_keywords:
18
18
19
19
## Cause
20
20
21
-
The callback assigned to <xref:Microsoft.IdentityModel.Tokens.AudienceValidator> or <xref:Microsoft.IdentityModel.Tokens.LifetimeValidator> always returns `true`.
21
+
The callback assigned to `AudienceValidator` or `LifetimeValidator` always returns `true`.
Copy file name to clipboardExpand all lines: docs/fundamentals/code-analysis/quality-rules/index.md
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -331,8 +331,8 @@ The following table lists code quality analysis rules.
331
331
> |[CA5401: Do not use CreateEncryptor with non-default IV](ca5401.md)| Symmetric encryption should always use a non-repeatable initialization vector to prevent dictionary attacks. |
332
332
> |[CA5402: Use CreateEncryptor with the default IV](ca5402.md)| Symmetric encryption should always use a non-repeatable initialization vector to prevent dictionary attacks. |
333
333
> |[CA5403: Do not hard-code certificate](ca5403.md)| The `data` or `rawData` parameter of a <xref:System.Security.Cryptography.X509Certificates.X509Certificate> or <xref:System.Security.Cryptography.X509Certificates.X509Certificate2> constructor is hard-coded. |
334
-
> |[CA5404: Do not disable token validation checks](ca5404.md)|<xref:Microsoft.IdentityModel.Tokens.TokenValidationParameters> properties that control token validation should not be set to `false`. |
335
-
> |[CA5405: Do not always skip token validation in delegates](ca5405.md)| The callback assigned to <xref:Microsoft.IdentityModel.Tokens.AudienceValidator> or <xref:Microsoft.IdentityModel.Tokens.LifetimeValidator> always returns `true`. |
334
+
> |[CA5404: Do not disable token validation checks](ca5404.md)|`TokenValidationParameters` properties that control token validation should not be set to `false`. |
335
+
> |[CA5405: Do not always skip token validation in delegates](ca5405.md)| The callback assigned to `AudienceValidator` or `LifetimeValidator` always returns `true`. |
336
336
> |[IL3000: Avoid accessing Assembly file path when publishing as a single file](../../../core/deploying/single-file/warnings/il3000.md)| Avoid accessing Assembly file path when publishing as a single file. |
337
337
> |[IL3001: Avoid accessing Assembly file path when publishing as a single-file](../../../core/deploying/single-file/warnings/il3001.md)| Avoid accessing Assembly file path when publishing as a single file. |
338
338
> |[IL3002: Avoid calling members annotated with 'RequiresAssemblyFilesAttribute' when publishing as a single file](../../../core/deploying/single-file/warnings/il3002.md)| Avoid calling members annotated with 'RequiresAssemblyFilesAttribute' when publishing as a single file|
Copy file name to clipboardExpand all lines: docs/fundamentals/code-analysis/quality-rules/security-warnings.md
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -112,5 +112,5 @@ Security rules support safer libraries and applications. These rules help preven
112
112
|[CA5401: Do not use CreateEncryptor with non-default IV](ca5401.md)|Symmetric encryption should always use a non-repeatable initialization vector to prevent dictionary attacks.|
113
113
|[CA5402: Use CreateEncryptor with the default IV](ca5402.md)|Symmetric encryption should always use a non-repeatable initialization vector to prevent dictionary attacks.|
114
114
|[CA5403: Do not hard-code certificate](ca5403.md)|The `data` or `rawData` parameter of a <xref:System.Security.Cryptography.X509Certificates.X509Certificate> or <xref:System.Security.Cryptography.X509Certificates.X509Certificate2> constructor is hard-coded.|
115
-
|[CA5404: Do not disable token validation checks](ca5404.md)|<xref:Microsoft.IdentityModel.Tokens.TokenValidationParameters> properties that control token validation should not be set to `false`. |
116
-
|[CA5405: Do not always skip token validation in delegates](ca5405.md)| The callback assigned to <xref:Microsoft.IdentityModel.Tokens.AudienceValidator> or <xref:Microsoft.IdentityModel.Tokens.LifetimeValidator> always returns `true`. |
115
+
|[CA5404: Do not disable token validation checks](ca5404.md)|`TokenValidationParameters` properties that control token validation should not be set to `false`. |
116
+
|[CA5405: Do not always skip token validation in delegates](ca5405.md)| The callback assigned to `AudienceValidator` or `LifetimeValidator` always returns `true`. |
0 commit comments