Skip to content
This repository was archived by the owner on Nov 19, 2024. It is now read-only.

Commit 4aa9cc6

Browse files
committedNov 7, 2024
Drop extra check of matching sub claims
Don't want to introduce new behavior in this security fix
1 parent f3753bd commit 4aa9cc6

File tree

1 file changed

+0
-7
lines changed

1 file changed

+0
-7
lines changed
 

‎src/Duende.AccessTokenManagement.OpenIdConnect/AuthenticationSessionUserTokenStore.cs

-7
Original file line numberDiff line numberDiff line change
@@ -70,13 +70,6 @@ public async Task<UserToken> GetTokenAsync(
7070
return new UserToken() { Error = "No properties on authentication result" };
7171
}
7272

73-
74-
// This "can't happen", but if it ever did, we would have a security problem
75-
if (result.Principal.FindFirstValue(JwtClaimTypes.Subject) != user.FindFirstValue(JwtClaimTypes.Subject))
76-
{
77-
throw new InvalidOperationException("Mismatch between expected user identity and cached authenticate result");
78-
}
79-
8073
return _tokensInProps.GetUserToken(result.Properties, parameters);
8174
}
8275

0 commit comments

Comments
 (0)
This repository has been archived.