Refreshing JWT adds duplicate audiences to token

JonPSmith / AuthPermissions.AspNetCore

This library provides extra authorization and multi-tenant features to an ASP.NET Core application.

https://www.thereformedprogrammer.net/finally-a-library-that-improves-role-authorization-in-asp-net-core/

MIT License

764 stars 155 forks source link

Refreshing JWT adds duplicate audiences to token #36

Closed akema-trebla closed 2 years ago

akema-trebla commented 2 years ago

The current implementation of getting the claims for the new token from the ClaimsPricipal of the expired token, creates duplicate audiences and thus fails after the first token refresh.

Recalculating the claims based on the userId from the ClaimsPrincipal resolves this issue.

JonPSmith commented 2 years ago

Hi @akema-trebla,

Thanks for the pull request. Version 3.2.1 includes your fix and another fix from @emorell96, and it is released as a NuGet package now.

akema-trebla commented 2 years ago

Hi @JonPSmith

That's great to know. Happy to help.