OnValidateIdentity disables the MVC OWIN remember me option

后端 未结 3 1011
太阳男子
太阳男子 2021-01-15 04:08

When I activate the OWIN logout-everywhere feature via security stamps and use the OnValidateIdentity-Callback of the CookieAuthenticationProvider

3条回答
  •  谎友^
    谎友^ (楼主)
    2021-01-15 04:40

    I have found the following code in the disassembly of SecurityStampValidator.OnValidateIdentity:

    // .. some other code
    // ...
    ClaimsIdentity claimsIdentity = await regenerateIdentityCallback(userManager, tUser);
    if (claimsIdentity != null){
    context.get_OwinContext().get_Authentication().SignIn(new ClaimsIdentity[]
        {
           claimsIdentity
        });
    }
    

    It seems to me, that the SignIn-operation is incomplete and should set the remember-me option? Therefore I assume that the implementation of SecurityStampValidator is buggy.

提交回复
热议问题