Skip to main content

AuthorizationValueReuseDetector Class

Abblix.Oidc.Server​

Abblix.Oidc.Server.Features.ReusePrevention​

AuthorizationValueReuseDetector Class​

Default IAuthorizationValueReuseDetector implementation backed by IEntityStorage. It records a SHA-256 hash of each value under a per-client, per-kind key with a time-to-live equal to the configured detection window, so a raw code_challenge or nonce never lands in the cache and entries expire on their own.

public class AuthorizationValueReuseDetector : Abblix.Oidc.Server.Features.ReusePrevention.IAuthorizationValueReuseDetector

Inheritance System.Object → AuthorizationValueReuseDetector

Implements IAuthorizationValueReuseDetector

Constructors​

AuthorizationValueReuseDetector(IEntityStorage, IEntityStorageKeyFactory, IOptions<OidcOptions>) Constructor​

Default IAuthorizationValueReuseDetector implementation backed by IEntityStorage. It records a SHA-256 hash of each value under a per-client, per-kind key with a time-to-live equal to the configured detection window, so a raw code_challenge or nonce never lands in the cache and entries expire on their own.

public AuthorizationValueReuseDetector(Abblix.Oidc.Server.Features.Storages.IEntityStorage storage, Abblix.Oidc.Server.Features.Storages.IEntityStorageKeyFactory keyFactory, Microsoft.Extensions.Options.IOptions<Abblix.Oidc.Server.Common.Configuration.OidcOptions> options);

Parameters​

storage IEntityStorage​
keyFactory IEntityStorageKeyFactory​
options Microsoft.Extensions.Options.IOptions<OidcOptions>​

Methods​

AuthorizationValueReuseDetector.IsReusedAsync(string, string, string) Method​

Reports whether a value of the given kind has already been recorded for this client within the detection window — that is, whether the client is repeating a value that must be unique per request.

public System.Threading.Tasks.Task<bool> IsReusedAsync(string clientId, string valueKind, string value);

Parameters​

clientId System.String​

The client presenting the value.

valueKind System.String​

A discriminator for the value's role (for example the parameter name), so a code_challenge and a nonce that happen to coincide are tracked separately.

value System.String​

The raw value; only a hash of it is ever stored.

Implements IsReusedAsync(string, string, string)

Returns​

System.Threading.Tasks.Task<System.Boolean>
true when the value was seen before within the window; otherwise false. Always false when detection is disabled.

AuthorizationValueReuseDetector.RecordAsync(string, string, string) Method​

Records a value as used by this client so a later reuse within the detection window is caught. A no-op when detection is disabled. Called once per issued authorization code, not on every authorization request, so re-processing one request across a login or consent redirect is not flagged.

public System.Threading.Tasks.Task RecordAsync(string clientId, string valueKind, string value);

Parameters​

clientId System.String​
valueKind System.String​
value System.String​

Implements RecordAsync(string, string, string)

Returns​

System.Threading.Tasks.Task