richard-churchman
1b9777fa71
* Fixed NullReferenceException: Addressed a crash in JwtSecurityTokenHandler under .NET 9 caused by internal changes in cryptographic primitives and claim handling. * Migrated JWT Handling: Updated Jwt.CreateToken to use JsonWebTokenHandler with SecurityTokenDescriptor. The method now returns a string directly (formerly JwtSecurityToken). * Configured AddJwtBearer with UseSecurityTokenValidators = false to ensure end-to-end consistency using JsonWebTokenHandler. * Updated AutoMapper: Adjusted the instantiation signature to include a null logger following the upgrade from v13 to v15 (required to patch a CodeQL security vulnerability). Resolved high-severity DoS vulnerability GHSA-rvv3-g6hj-g44x (uncontrolled recursion) and fixed the new instantiation signature requiring a null logger.
46 lines
1.8 KiB
C#
46 lines
1.8 KiB
C#
/* Copyright (C) 2022-present Jube Holdings Limited.
|
|
*
|
|
* This file is part of Jube™ software.
|
|
*
|
|
* Jube™ is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License
|
|
* as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
|
|
* Jube™ is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty
|
|
* of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.
|
|
|
|
* You should have received a copy of the GNU Affero General Public License along with Jube™. If not,
|
|
* see <https://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
namespace Jube.App.Code
|
|
{
|
|
using System;
|
|
using System.Collections.Generic;
|
|
using System.Security.Claims;
|
|
using System.Text;
|
|
using Microsoft.IdentityModel.JsonWebTokens;
|
|
using Microsoft.IdentityModel.Tokens;
|
|
|
|
public static class Jwt
|
|
{
|
|
public static string CreateToken(string userName, string jwtKey, string jwtIssuer, string jwtAudience)
|
|
{
|
|
var descriptor = new SecurityTokenDescriptor
|
|
{
|
|
Subject = new ClaimsIdentity(new List<Claim>
|
|
{
|
|
new Claim(ClaimTypes.Name, userName)
|
|
}),
|
|
Expires = DateTime.UtcNow.AddMinutes(15),
|
|
Issuer = jwtIssuer,
|
|
Audience = jwtAudience,
|
|
SigningCredentials = new SigningCredentials(
|
|
new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtKey)),
|
|
SecurityAlgorithms.HmacSha256
|
|
)
|
|
};
|
|
|
|
return new JsonWebTokenHandler().CreateToken(descriptor);
|
|
}
|
|
}
|
|
}
|