Allow clients to control the how the cache key is generated from a token.

IdentityModel / IdentityModel.AspNetCore.OAuth2Introspection

ASP.NET Core authentication handler for OAuth 2.0 token introspection

Apache License 2.0

147 stars 66 forks source link

Closed ghstahl closed 3 years ago

leastprivilege commented 3 years ago

Should we have tests for that?

ghstahl commented 3 years ago

it depends ;

The library never had tests for itself around generating the key. $"{options.CacheKeyPrefix}{token.Sha256()}" No, its status quo here.
If we want to start enforcing key length because of the OAuth2IntrospectionOptions.CacheKeyPrefix, then Yes. We add a runtime check that needs a test

The only 2 problems I see is a key length that runs afoul of the backing cache and a user's bad key generation algorithm which causes collisions.

github-actions[bot] commented 2 years ago

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue.