oauth 2.0 - Security stamp validator in jwtBearerMiddleware -

i've oauth2 resource server uses jwtbearermiddleware validate access tokens. wan't access token invalid if security stamp has changed. looks middleware doesn't validate security stamp itself.

i've found securitystampvalidator class seems validate cookie authentication.

where , how have validate security stamp json web token?

---

my current way register eventhandler ontokenvalidated event when register jwtbearermiddleware. in eventhandler query database security claim , compare 1 in token. when security stamp isn't same set ticket , securitytoken of context null , skip next middleware throw 401 http status code if authentication required.

app.usejwtbearerauthentication(new jwtbeareroptions {     ...     events = new jwtbearerevents     {         ontokenvalidated = async (ctx) =>          {             var securitystampclaim = ctx.ticket.principal.claims.firstordefault(claim => claim.type == "aspnet.identity.securitystamp");             var subjectclaim = ctx.ticket.principal.claims.firstordefault(claim => claim.type == openidconnectconstants.claims.subject);              if (securitystampclaim == null || subjectclaim == null)                 return;              var user = await userstore.findbyidasync(subjectclaim.value, ctx.httpcontext.requestaborted);             if (user?.securitystamp == securitystampclaim.value)                 return;              ctx.securitytoken = null;             ctx.ticket = null;             ctx.skiptonextmiddleware();         }     } }); 

is how should done?

is how should done?

technically, yes (you use signinmanager.validatesecuritystampasync(principal) simplify code bit).

that said, you should consider avoiding storing security stamps in jwt tokens because not "opaque" strings used determine whether token or cookie should considered revoked, used sole source of entropy asp.net core identity generate 2fa tokens: if store them as-is in jwt, can extracted malicious third-party client application , used predict valid 2fa codes logged in user.

this known issue, afaik, there's no plan fix it: https://github.com/aspnet/identity/issues/626.

if want store security stamps in access tokens, consider using openiddict's default (encrypted) format, same 1 used asp.net core encrypted authentication cookies.