Need to check for 'null-or-empty' issuer signing keys (#2057)

dannybtsai · web-flow · commit 3d91c43a4bef · 2023-04-19T12:45:21.000-07:00
diff --git a/src/Microsoft.IdentityModel.JsonWebTokens/JsonWebTokenHandler.cs b/src/Microsoft.IdentityModel.JsonWebTokens/JsonWebTokenHandler.cs
@@ -1547,7 +1547,7 @@ private static JsonWebToken ValidateSignature(JsonWebToken jwtToken, TokenValida
                 }
             }
 
-            if (keys == null && validationParameters.TryAllIssuerSigningKeys)
+            if (validationParameters.TryAllIssuerSigningKeys && keys.IsNullOrEmpty())
             {
                 // control gets here if:
                 // 1. User specified delegate: IssuerSigningKeyResolver returned null

Original file line number	Diff line number	Diff line change
`@@ -1547,7 +1547,7 @@ private static JsonWebToken ValidateSignature(JsonWebToken jwtToken, TokenValida`
`1547`	`1547`	`}`
`1548`	`1548`	`}`
`1549`	`1549`
`1550`		`- if (keys == null && validationParameters.TryAllIssuerSigningKeys)`
	`1550`	`+ if (validationParameters.TryAllIssuerSigningKeys && keys.IsNullOrEmpty())`
`1551`	`1551`	`{`
`1552`	`1552`	`// control gets here if:`
`1553`	`1553`	`// 1. User specified delegate: IssuerSigningKeyResolver returned null`