| | | 1 | | using Elsa.Identity.Options; |
| | | 2 | | using Microsoft.Extensions.Hosting; |
| | | 3 | | using Microsoft.Extensions.Options; |
| | | 4 | | |
| | | 5 | | // ReSharper disable once CheckNamespace |
| | | 6 | | namespace Elsa.Extensions; |
| | | 7 | | |
| | | 8 | | /// <summary> |
| | | 9 | | /// Validates the <see cref="IdentityTokenOptions"/>. |
| | | 10 | | /// </summary> |
| | | 11 | | public class ValidateIdentityTokenOptions : IValidateOptions<IdentityTokenOptions> |
| | | 12 | | { |
| | | 13 | | private const int MinimumSigningKeyByteLength = 32; |
| | | 14 | | private const string DemoEnvironmentName = "Demo"; |
| | | 15 | | |
| | 2 | 16 | | private static readonly HashSet<string> KnownDefaultSigningKeys = new(StringComparer.OrdinalIgnoreCase) |
| | 2 | 17 | | { |
| | 2 | 18 | | "sufficiently-large-secret-signing-key", |
| | 2 | 19 | | "CHANGE_ME_TO_A_SECURE_RANDOM_KEY" |
| | 2 | 20 | | }; |
| | | 21 | | |
| | | 22 | | private readonly IHostEnvironment? _environment; |
| | | 23 | | |
| | | 24 | | /// <summary> |
| | | 25 | | /// Initializes a new instance of the <see cref="ValidateIdentityTokenOptions"/> class. |
| | | 26 | | /// </summary> |
| | 17 | 27 | | public ValidateIdentityTokenOptions() |
| | | 28 | | { |
| | 17 | 29 | | } |
| | | 30 | | |
| | | 31 | | /// <summary> |
| | | 32 | | /// Initializes a new instance of the <see cref="ValidateIdentityTokenOptions"/> class. |
| | | 33 | | /// </summary> |
| | 9 | 34 | | public ValidateIdentityTokenOptions(IHostEnvironment environment) |
| | | 35 | | { |
| | 9 | 36 | | _environment = environment; |
| | 9 | 37 | | } |
| | | 38 | | |
| | | 39 | | /// <inheritdoc /> |
| | | 40 | | public ValidateOptionsResult Validate(string? name, IdentityTokenOptions options) |
| | | 41 | | { |
| | 26 | 42 | | if (string.IsNullOrWhiteSpace(options.SigningKey)) |
| | 4 | 43 | | return ValidateOptionsResult.Fail("SigningKey is required. Configure a secure random JWT signing key through |
| | | 44 | | |
| | 22 | 45 | | var signingKey = options.SigningKey.Trim(); |
| | | 46 | | |
| | 22 | 47 | | if (!string.Equals(signingKey, options.SigningKey, StringComparison.Ordinal)) |
| | 4 | 48 | | return ValidateOptionsResult.Fail("SigningKey must not contain leading or trailing whitespace. Configure the |
| | | 49 | | |
| | 18 | 50 | | if (KnownDefaultSigningKeys.Contains(signingKey)) |
| | | 51 | | { |
| | 10 | 52 | | if (!IsDemoOrDevelopment()) |
| | 8 | 53 | | return ValidateOptionsResult.Fail("SigningKey uses a known public default value. Replace it with a secur |
| | | 54 | | |
| | 2 | 55 | | return ValidateOptionsResult.Success; |
| | | 56 | | } |
| | | 57 | | |
| | 8 | 58 | | if (!IsPrintableAscii(signingKey)) |
| | 2 | 59 | | return ValidateOptionsResult.Fail("SigningKey contains non-printable or non-ASCII characters. Configure a se |
| | | 60 | | |
| | 6 | 61 | | if (signingKey.Length < MinimumSigningKeyByteLength) |
| | 2 | 62 | | return ValidateOptionsResult.Fail($"SigningKey must be at least {MinimumSigningKeyByteLength} ASCII characte |
| | | 63 | | |
| | 4 | 64 | | return ValidateOptionsResult.Success; |
| | | 65 | | } |
| | | 66 | | |
| | | 67 | | private bool IsDemoOrDevelopment() |
| | | 68 | | { |
| | 10 | 69 | | return _environment is not null && (_environment.IsDevelopment() || string.Equals(_environment.EnvironmentName, |
| | | 70 | | } |
| | | 71 | | |
| | 268 | 72 | | private static bool IsPrintableAscii(string value) => value.All(x => x is >= ' ' and <= '~'); |
| | | 73 | | } |