Add token life time and issuer validation (#374)

Ed-Fi-Alliance-OSS · Dec 18, 2024 · 769826a · 769826a
1 parent b9cc269
commit 769826a
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 2 deletions.
diff --git a/...onfigurationService.Frontend.AspNetCore/Infrastructure/WebApplicationBuilderExtensions.cs b/...onfigurationService.Frontend.AspNetCore/Infrastructure/WebApplicationBuilderExtensions.cs
@@ -129,7 +129,10 @@ Serilog.ILogger logger
                     options.TokenValidationParameters = new TokenValidationParameters
                     {
                         ValidateAudience = true,
+                        ValidAudience = identitySettings.Audience,
                         ValidateIssuer = true,
+                        ValidIssuer = identitySettings.Authority,
+                        ValidateLifetime = true,
                         RoleClaimType = identitySettings.RoleClaimType,
                     };
 

diff --git a/...taManagementService.Frontend.AspNetCore/Infrastructure/WebApplicationBuilderExtensions.cs b/...taManagementService.Frontend.AspNetCore/Infrastructure/WebApplicationBuilderExtensions.cs
@@ -93,7 +93,6 @@ Serilog.ILogger ConfigureLogging()
         webAppBuilder.Services.Configure<IdentitySettings>(settings);
         webAppBuilder.Services.AddHttpClient();
 
-
         if (identitySettings.EnforceAuthorization)
         {
             string metadataAddress = $"{identitySettings.Authority}/.well-known/openid-configuration";
@@ -111,7 +110,10 @@ Serilog.ILogger ConfigureLogging()
                         options.TokenValidationParameters = new TokenValidationParameters
                         {
                             ValidateAudience = true,
-                            ValidateIssuer = false,
+                            ValidAudience = identitySettings.Audience,
+                            ValidateIssuer = true,
+                            ValidIssuer = identitySettings.Authority,
+                            ValidateLifetime = true,
                             RoleClaimType = identitySettings.RoleClaimType,
                         };