Fail closed on malformed local auth

2026-04-11 16:29:53 +02:00
parent 6a223a4b70
commit 09e96ce381
6 changed files with 90 additions and 19 deletions
@@ -253,6 +253,17 @@ builder.Services.AddAuthentication(options =>
                    context.Token = cookieToken;
                }

+                return Task.CompletedTask;
+            },
+            OnTokenValidated = context =>
+            {
+                var userId = LocalAuthIdentity.GetRequiredUserId(context.Principal);
+                if (userId is not null)
+                {
+                    return Task.CompletedTask;
+                }
+
+                context.Fail("Local tokens must include a subject/nameidentifier claim.");
                return Task.CompletedTask;
            }
        };