search

AzureAD / microsoft-authentication-library-for-dotnet

Microsoft Authentication Library (MSAL) for .NET
https://aka.ms/msal-net
MIT License
1.38k stars 338 forks source link

Does MSAL.net handle nonce validation by default? #4935

Open anhhnguyen206 opened 1 day ago

anhhnguyen206 commented 1 day ago

Hi,

This is more like a question than an issue but I didn't see a discussion place for generic question so I open this. Feel free to close and redirect me to a better place to ask.

We're doing pentesting of our application. We noticed that in the token payload that we received as the AuthenticationResult, we have a nonce value which is a random string. I'm curious if this is generated by the library and is it also validated by the library?

Thanks,

bgavrilMS commented 1 day ago

Clients (and the SDK) do not parse access tokens. They could be encrypted. Only the resource (the audience) parses access tokens.

Tokens are cached, the same token can be used multiple times to call a resource.