Skip to content

Commit 1619c36

Browse files
iNinjaHP712
iNinja
and
HP712
authored
Add initial regression tests for the new validation path (#2810)
* Added initial validation tests between ValidateTokenAsync using TokenValidationParameters and ValidationParameters Added error message when validating a signature and the key is not found using the kid, without trying all keys * Updated remaining files post merge from dev * Removed null inner exception parameter as it is not needed. * Added tests around invalid signature. * Updated log message to match the variable name * Removed JwtSecurityTokenHandler as it is not used. * Addressed PR feedback * Updated names on diff * Moved StackFrame to central file. Added ctor JsonWebTokenHandlerValidationParametersTheoryData to take TestId. --------- Co-authored-by: id4s <[email protected]>
1 parent 191329c commit 1619c36

15 files changed

+269
-67
lines changed

‎src/Microsoft.IdentityModel.JsonWebTokens/JsonWebTokenHandler.DecryptToken.cs

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -215,8 +215,7 @@ internal Result<string> DecryptToken(
215215
LogHelper.MarkAsSecurityArtifact(jwtToken, JwtTokenUtilities.SafeLogJwtToken)),
216216
ValidationFailureType.TokenDecryptionFailed,
217217
typeof(SecurityTokenKeyWrapException),
218-
decryptionKeyUnwrapFailedStackFrame,
219-
null);
218+
decryptionKeyUnwrapFailedStackFrame);
220219

221220
return (null, exceptionDetail);
222221
}

‎src/Microsoft.IdentityModel.JsonWebTokens/JsonWebTokenHandler.ValidateSignature.cs

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,6 @@ namespace Microsoft.IdentityModel.JsonWebTokens
1616
/// <remarks>This partial class contains methods and logic related to the validation of tokens' signatures.</remarks>
1717
public partial class JsonWebTokenHandler : TokenHandler
1818
{
19-
static internal class SignatureStackFrames
20-
{
21-
// Test StackFrame to validate caching solution. Need to add all the possible stack frames.
22-
static internal StackFrame? NoKeysProvided;
23-
}
2419
/// <summary>
2520
/// Validates the JWT signature.
2621
/// </summary>
@@ -96,12 +91,27 @@ internal static Result<SecurityKey> ValidateSignature(
9691
return ValidateSignatureUsingAllKeys(jwtToken, validationParameters, configuration, callContext);
9792
else
9893
{
99-
StackFrame stackFrame = SignatureStackFrames.NoKeysProvided ??= new StackFrame(true);
94+
if (!string.IsNullOrEmpty(jwtToken.Kid))
95+
{
96+
StackFrame kidNotMatchedNoTryAllStackFrame = StackFrames.KidNotMatchedNoTryAll ??= new StackFrame(true);
97+
return new ExceptionDetail(
98+
new MessageDetail(
99+
TokenLogMessages.IDX10502,
100+
LogHelper.MarkAsNonPII(jwtToken.Kid),
101+
LogHelper.MarkAsNonPII(validationParameters.IssuerSigningKeys.Count),
102+
LogHelper.MarkAsNonPII(configuration?.SigningKeys.Count ?? 0),
103+
LogHelper.MarkAsSecurityArtifact(jwtToken.EncodedToken, JwtTokenUtilities.SafeLogJwtToken)),
104+
ValidationFailureType.SignatureValidationFailed,
105+
typeof(SecurityTokenSignatureKeyNotFoundException),
106+
kidNotMatchedNoTryAllStackFrame);
107+
}
108+
109+
StackFrame noKeysProvidedStackFrame = StackFrames.NoKeysProvided ??= new StackFrame(true);
100110
return new ExceptionDetail(
101111
new MessageDetail(TokenLogMessages.IDX10500),
102112
ValidationFailureType.SignatureValidationFailed,
103113
typeof(SecurityTokenSignatureKeyNotFoundException),
104-
stackFrame);
114+
noKeysProvidedStackFrame);
105115
}
106116
}
107117

‎src/Microsoft.IdentityModel.JsonWebTokens/JsonWebTokenHandler.ValidateToken.StackFrames.cs

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,9 @@ internal static class StackFrames
4848
// ReadToken
4949
internal static StackFrame? ReadTokenNullOrEmpty;
5050
internal static StackFrame? ReadTokenMalformed;
51+
// ValidateSignature
52+
internal static StackFrame? KidNotMatchedNoTryAll;
53+
internal static StackFrame? NoKeysProvided;
5154
}
5255
}
5356
}

‎src/Microsoft.IdentityModel.JsonWebTokens/JwtTokenUtilities.cs

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -373,8 +373,7 @@ private static ExceptionDetail GetDecryptionError(
373373
LogHelper.MarkAsSecurityArtifact(decryptionParameters.EncodedToken, SafeLogJwtToken)),
374374
ValidationFailureType.TokenDecryptionFailed,
375375
typeof(SecurityTokenDecryptionFailedException),
376-
new StackFrame(true),
377-
null);
376+
new StackFrame(true));
378377
else if (algorithmNotSupportedByCryptoProvider)
379378
return new ExceptionDetail(
380379
new MessageDetail(

‎src/Microsoft.IdentityModel.Tokens/LogMessages.cs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,7 @@ internal static class LogMessages
8989
// 10500 - SignatureValidation
9090
public const string IDX10500 = "IDX10500: Signature validation failed. No security keys were provided to validate the signature.";
9191
//public const string IDX10501 = "IDX10501: Signature validation failed. Unable to match key: \nkid: '{0}'. \nNumber of keys in TokenValidationParameters: '{1}'. \nNumber of keys in Configuration: '{2}'. \nExceptions caught:\n '{3}'. \ntoken: '{4}'.";
92+
public const string IDX10502 = "IDX10502: Signature validation failed. The token's kid is: '{0}', but did not match any keys in ValidationParameters or Configuration and TryAllIssuerSigningKeys is false. Number of keys in ValidationParameters: '{1}'. \nNumber of keys in Configuration: '{2}'.\ntoken: '{3}'.";
9293
public const string IDX10503 = "IDX10503: Signature validation failed. The token's kid is: '{0}', but did not match any keys in TokenValidationParameters or Configuration. Keys tried: '{1}'. Number of keys in TokenValidationParameters: '{2}'. \nNumber of keys in Configuration: '{3}'. \nExceptions caught:\n '{4}'.\ntoken: '{5}'. See https://aka.ms/IDX10503 for details.";
9394
public const string IDX10504 = "IDX10504: Unable to validate signature, token does not have a signature: '{0}'.";
9495
public const string IDX10505 = "IDX10505: Signature validation failed. The user defined 'Delegate' specified on TokenValidationParameters returned null when validating token: '{0}'.";

‎test/Microsoft.IdentityModel.JsonWebTokens.Tests/JsonWebTokenHandler.DecryptTokenTests.cs

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33

44
using System;
55
using System.IdentityModel.Tokens.Jwt.Tests;
6-
using Microsoft.IdentityModel.Abstractions;
76
using Microsoft.IdentityModel.Logging;
87
using Microsoft.IdentityModel.TestUtils;
98
using Microsoft.IdentityModel.Tokens;
@@ -112,7 +111,6 @@ public static TheoryData<TokenDecryptingTheoryData> JsonWebTokenHandlerDecryptTo
112111
new MessageDetail(TokenLogMessages.IDX10612),
113112
ValidationFailureType.TokenDecryptionFailed,
114113
typeof(SecurityTokenException),
115-
null,
116114
null),
117115
},
118116
new TokenDecryptingTheoryData
@@ -125,7 +123,6 @@ public static TheoryData<TokenDecryptingTheoryData> JsonWebTokenHandlerDecryptTo
125123
new MessageDetail(TokenLogMessages.IDX10000, "jwtToken"),
126124
ValidationFailureType.NullArgument,
127125
typeof(ArgumentNullException),
128-
null,
129126
null),
130127
},
131128
new TokenDecryptingTheoryData
@@ -138,7 +135,6 @@ public static TheoryData<TokenDecryptingTheoryData> JsonWebTokenHandlerDecryptTo
138135
new MessageDetail(TokenLogMessages.IDX10000, "validationParameters"),
139136
ValidationFailureType.NullArgument,
140137
typeof(ArgumentNullException),
141-
null,
142138
null),
143139
},
144140
new TokenDecryptingTheoryData
@@ -196,7 +192,6 @@ public static TheoryData<TokenDecryptingTheoryData> JsonWebTokenHandlerDecryptTo
196192
JwtTokenUtilities.SafeLogJwtToken)),
197193
ValidationFailureType.TokenDecryptionFailed,
198194
typeof(SecurityTokenDecryptionFailedException),
199-
null,
200195
null),
201196
}
202197
};

‎test/Microsoft.IdentityModel.JsonWebTokens.Tests/JsonWebTokenHandler.ReadTokenTests.cs

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,6 @@ public static TheoryData<TokenReadingTheoryData> JsonWebTokenHandlerReadTokenTes
7878
LogHelper.MarkAsNonPII("token")),
7979
ValidationFailureType.NullArgument,
8080
typeof(ArgumentNullException),
81-
null,
8281
null)
8382
},
8483
new TokenReadingTheoryData
@@ -92,7 +91,6 @@ public static TheoryData<TokenReadingTheoryData> JsonWebTokenHandlerReadTokenTes
9291
LogHelper.MarkAsNonPII("token")),
9392
ValidationFailureType.NullArgument,
9493
typeof(ArgumentNullException),
95-
null,
9694
null)
9795
},
9896
new TokenReadingTheoryData

‎test/Microsoft.IdentityModel.JsonWebTokens.Tests/JsonWebTokenHandler.ValidateSignatureTests.cs

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,6 @@ public static TheoryData<JsonWebTokenHandlerValidateSignatureTheoryData> JsonWeb
8888
"jwtToken"),
8989
ValidationFailureType.NullArgument,
9090
typeof(ArgumentNullException),
91-
null,
9291
null)
9392
},
9493
new JsonWebTokenHandlerValidateSignatureTheoryData {
@@ -102,7 +101,6 @@ public static TheoryData<JsonWebTokenHandlerValidateSignatureTheoryData> JsonWeb
102101
"validationParameters"),
103102
ValidationFailureType.NullArgument,
104103
typeof(ArgumentNullException),
105-
null,
106104
null)
107105
},
108106
new JsonWebTokenHandlerValidateSignatureTheoryData {
@@ -119,7 +117,6 @@ public static TheoryData<JsonWebTokenHandlerValidateSignatureTheoryData> JsonWeb
119117
"fakeParameter"),
120118
ValidationFailureType.NullArgument,
121119
typeof(ArgumentNullException),
122-
null,
123120
null)
124121
},
125122
new JsonWebTokenHandlerValidateSignatureTheoryData
@@ -134,7 +131,6 @@ public static TheoryData<JsonWebTokenHandlerValidateSignatureTheoryData> JsonWeb
134131
LogHelper.MarkAsSecurityArtifact(unsignedToken, JwtTokenUtilities.SafeLogJwtToken)),
135132
ValidationFailureType.SignatureValidationFailed,
136133
typeof(SecurityTokenInvalidSignatureException),
137-
null,
138134
null)
139135
},
140136
new JsonWebTokenHandlerValidateSignatureTheoryData
@@ -204,20 +200,18 @@ public static TheoryData<JsonWebTokenHandlerValidateSignatureTheoryData> JsonWeb
204200
new MessageDetail(TokenLogMessages.IDX10500),
205201
ValidationFailureType.SignatureValidationFailed,
206202
typeof(SecurityTokenSignatureKeyNotFoundException),
207-
null,
208203
null)
209204
},
210205
new JsonWebTokenHandlerValidateSignatureTheoryData
211206
{
212207
TestId = "Invalid_NoKeys",
213208
JWT = new JsonWebToken(EncodedJwts.LiveJwt),
214209
ValidationParameters = new ValidationParameters(),
215-
ExpectedException = ExpectedException.SecurityTokenSignatureKeyNotFoundException("IDX10500:"),
210+
ExpectedException = ExpectedException.SecurityTokenSignatureKeyNotFoundException("IDX10502:"),
216211
Result = new ExceptionDetail(
217212
new MessageDetail(TokenLogMessages.IDX10500),
218213
ValidationFailureType.SignatureValidationFailed,
219214
typeof(SecurityTokenSignatureKeyNotFoundException),
220-
null,
221215
null)
222216
}
223217
};

0 commit comments

Comments
 (0)