Must validate the AAD key issuer if you use IdentityModel directly to validate Azure AD tokens. See the link below for details
+Must validate the AAD key issuer if you use IdentityModel directly to validate Azure AD tokens. See the link below for details
+JsonWebTokenHandler.ValidateToken returns a TokenValidationResult object but does not throw an exception when token validation fails.
Instead, developers must explicitly check the IsValid property or the Exception property of the TokenValidationResult.
+If neither check is performed, the application may treat an invalid token as valid, leading to security vulnerabilities such as unauthorized access.
Always verify the TokenValidationResult returned by ValidateToken by checking the IsValid property or Exception property.
By setting TokenValidationParameter.SignatureValidator validation delegate to a callable that never throws an Exception, validation of the token signature is disabled. Disabling safeguards can lead to security compromise of tokens from any issuer.
Improve the logic of the delegate so to throw an SecurityTokenException in failure cases when you want to fail validation.
This example delegates SignatureValidator to a callable that always returns a Microsoft.IdentityModel.Tokens.SecurityToken.
To fix it, use a callable that performs a validation, and fails when appropriate.
+By setting TokenValidationParameter.IssuerValidator validation delegate to a callable that always return the issuer argument (1st argument), important authentication safeguards are disabled. Disabling safeguards can lead to incorrect validation of tokens from any issuer.
Improve the logic of the delegate so not all code paths return issuer, which effectively disables that type of validation; or throw SecurityTokenException in failure cases when you want to fail validation.
+
This example delegates IssuerValidator to a callable that always returns the issuer.
To fix it, use a callable that performs a validation, and fails when appropriate.
+By setting critical TokenValidationParameter validation delegates to always return true, important authentication safeguards are disabled. Disabling safeguards can lead to incorrect validation of tokens from any issuer or expired tokens.
Improve the logic of the delegate so not all code paths return true, which effectively disables that type of validation; or throw SecurityTokenInvalidAudienceException or SecurityTokenInvalidLifetimeException in failure cases when you want to fail validation and have other cases pass by returning true.
+
This example delegates AudienceValidator to a callable that always returns true.
To fix it, use a callable that performs a validation, and fails when appropriate.
+Token validation checks ensure that while validating tokens, all aspects are analyzed and verified. Turning off validation can lead to security holes by allowing untrusted tokens to make it through validation.
+ +Set Microsoft.IdentityModel.Tokens.TokenValidationParameters property ValidateIssuer to true. Or, remove the assignment to false because the default value is true.
This example disabled the validation.
+To fix it, do not disable the validations or use the default value.
+Token validation checks ensure that while validating tokens, all aspects are analyzed and verified. Turning off validation can lead to security holes by allowing untrusted tokens to make it through validation.
+ +Set Microsoft.IdentityModel.Tokens.TokenValidationParameters properties RequireExpirationTime, ValidateAudience, ValidateIssuer, or ValidateLifetime to true. Or, remove the assignment to false because the default value is true.
This example disabled the validation.
+To fix it, do not disable the validations or use the default value.
+