Skip to content

AddIdentityServerJwt might accidentally use the wrong issuer URL. #28880

Open
@SebastianStehle

Description

@SebastianStehle

Describe the bug

When using AddIdentityServerJwt the IssuerURL seems to be derived from the actual request. The option management hooks into the events and enriches the options with the host name from the request:

if (options.TokenValidationParameters.ValidIssuer == null || options.TokenValidationParameters.IssuerSigningKey == null)

When the first request that comes in is not the public host name, the options is enriched with the wrong host and all subsequent calls to authorize fail because the issuer URL does not match.

Consider a scenario where you have a health check running. The health service uses the internal IP (e.g. in kubernetes) to call the health endpoint and the issuer URL is configured with the IP address.

To Reproduce

  1. Create a new SPA sample (dotnet new react -au Individual)
  2. Login
  3. Restart the server
  4. Go to https://127.0.0.1:5001 before you go to any other URL
  5. Go to https://localhost:5001 and press fetch data

The result in Chrome:

Bearer error="invalid_token", error_description="The issuer 'https://localhost:5001' is invalid"

Further technical details

  • ASP.NET Core version 5

Metadata

Metadata

Assignees

No one assigned

    Labels

    area-authIncludes: Authn, Authz, OAuth, OIDC, Bearer

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions