huahaofeng
/
aspnetcore
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

#390 Make the nonce cookie expire.

This commit is contained in:
Chris R 2015-09-03 17:54:09 -07:00
parent 5bc13cbd6b
commit 9f7a723843
3 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/Microsoft.AspNet.Authentication.OpenIdConnect/OpenIdConnectAuthenticationHandler.cs
View File

@ -666,7 +666,8 @@ namespace Microsoft.AspNet.Authentication.OpenIdConnect
new CookieOptions
{
HttpOnly = true,
Secure = Request.IsHttps
Secure = Request.IsHttps,
Expires = DateTime.UtcNow + Options.ProtocolValidator.NonceLifetime
});
}

6
src/Microsoft.AspNet.Authentication.OpenIdConnect/OpenIdConnectAuthenticationOptions.cs
View File

@ -169,7 +169,11 @@ namespace Microsoft.AspNet.Authentication.OpenIdConnect
/// is valid per: http://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
/// </summary>
/// <exception cref="ArgumentNullException">if 'value' is null.</exception>
public OpenIdConnectProtocolValidator ProtocolValidator { get; set; } = new OpenIdConnectProtocolValidator { RequireState = false };
public OpenIdConnectProtocolValidator ProtocolValidator { get; set; } = new OpenIdConnectProtocolValidator()
{
RequireState = false,
NonceLifetime = TimeSpan.FromMinutes(15)
};
/// <summary>
/// Gets or sets the 'post_logout_redirect_uri'

1
test/Microsoft.AspNet.Authentication.Test/OpenIdConnect/OpenIdConnectMiddlewareTests.cs
View File

@ -83,6 +83,7 @@ namespace Microsoft.AspNet.Authentication.Tests.OpenIdConnect
});
var transaction = await SendAsync(server, DefaultHost + Challenge);
transaction.SetCookie.Single().ShouldContain(OpenIdConnectAuthenticationDefaults.CookieNoncePrefix);
transaction.SetCookie.Single().ShouldContain("Expires");
}
[Fact]