Class UnverifiedJsonWebToken
- Namespace
- MailFathom.Infrastructure.Security.OAuth
- Assembly
- MailFathom.Infrastructure.dll
Reads what a JSON Web Token says about itself, before anything has been verified.
public static class UnverifiedJsonWebToken- Inheritance
-
UnverifiedJsonWebToken
- Inherited Members
Remarks
A deployment can trust several authorization servers and can accept a credential a client minted for itself, and the
token is the only thing that says which of them it is. Choosing a validator therefore has to read the token's own
iss claim and its own declared type first — both unsigned input, chosen by whoever sent the request, and the
name of this type says so at every call site.
What the value is allowed to decide is the point. It selects which configured profile validates the token, and that
profile then checks the signature against its own key set and compares iss against its own configured issuer.
A token claiming an issuer nobody configured selects no profile and is refused; a token claiming one profile's issuer
while carrying another's signature fails that profile's signature check. So the worst an attacker achieves by writing
whatever they like here is to pick which validator rejects them.
Nothing else is read. The remaining claims are the validated token's business, and reading one here would make an unverified assertion look like an established fact somewhere further down.
Methods
- TryReadClaimedIssuer(ReadOnlySpan<char>, out string?)
Reads the issuer a compact-serialized JSON Web Token claims, from characters that are not a string.
- TryReadClaimedIssuer(string?, out string?)
Reads the issuer a compact-serialized JSON Web Token claims.
- TryReadDeclaredType(string?, out string?)
Reads the media type a compact-serialized JSON Web Token declares for itself.