4f0a837e20
* Turn SlidingExpiration off and only renew cookie of not RemainingSeconds request Also adds the TicketExpiresClaim before validating the the security stamp, otherwise the claim won't be merged and "dissappear", leading to the user being instantly logged out Also only EnsureValidSessionId if not RemainingSeconds request, otherwise the session will always be valid, since the remaining seconds request renews it. * Don't ignore SessionIdClaimType and Cookiepath when merging claims Besides what the comment used to state these claims are only issued when logging in, leading you to be logged out once the claims are merged, furthermore when we check the session ID we verify that you session has not expired. * Manually specify Issued and Expires when renewing token If we don't we lose 30 minutes of our ExpireTimeSpan every time the principal refreshes * Re-add ignored claims And use MergeAllClaims on refreshing principal instead. * EnsureValidSessionId before updating IssuedUtc * Fix comment * Update src/Umbraco.Web.BackOffice/Security/ConfigureBackOfficeCookieOptions.cs Co-authored-by: nikolajlauridsen <nel@umbraco.dk> Co-authored-by: Bjarke Berg <mail@bergmania.dk>
41 lines
1.5 KiB
C#
41 lines
1.5 KiB
C#
using System;
|
|
using System.Linq;
|
|
using System.Security.Claims;
|
|
using System.Threading.Tasks;
|
|
using Microsoft.AspNetCore.Identity;
|
|
using Microsoft.Extensions.Options;
|
|
using Umbraco.Extensions;
|
|
|
|
namespace Umbraco.Cms.Web.Common.Security
|
|
{
|
|
public class ConfigureSecurityStampOptions : IConfigureOptions<SecurityStampValidatorOptions>
|
|
{
|
|
public void Configure(SecurityStampValidatorOptions options)
|
|
=> ConfigureOptions(options);
|
|
|
|
/// <summary>
|
|
/// Configures security stamp options and ensures any custom claims
|
|
/// set on the identity are persisted to the new identity when it's refreshed.
|
|
/// </summary>
|
|
/// <param name="options"></param>
|
|
public static void ConfigureOptions(SecurityStampValidatorOptions options)
|
|
{
|
|
options.ValidationInterval = TimeSpan.FromMinutes(30);
|
|
|
|
// When refreshing the principal, ensure custom claims that
|
|
// might have been set with an external identity continue
|
|
// to flow through to this new one.
|
|
options.OnRefreshingPrincipal = refreshingPrincipal =>
|
|
{
|
|
ClaimsIdentity newIdentity = refreshingPrincipal.NewPrincipal.Identities.First();
|
|
ClaimsIdentity currentIdentity = refreshingPrincipal.CurrentPrincipal.Identities.First();
|
|
|
|
// Since this is refreshing an existing principal, we want to merge all claims.
|
|
newIdentity.MergeAllClaims(currentIdentity);
|
|
|
|
return Task.CompletedTask;
|
|
};
|
|
}
|
|
}
|
|
}
|