SecretLengthOptionsValidator Class
Fails loudly at startup when a configured secret-bearing length is below the security floor for its kind, instead of silently generating a guessable client secret, authorization code or identifier at runtime. Every shipped default is already at or above these floors, so a valid configuration is unaffected; the validator only rejects a deliberately shortened value.
public class SecretLengthOptionsValidator : Microsoft.Extensions.Options.IValidateOptions<Abblix.Oidc.Server.Common.Configuration.OidcOptions>Inheritance System.Object → SecretLengthOptionsValidator
Implements Microsoft.Extensions.Options.IValidateOptions<OidcOptions>
Fields
SecretLengthOptionsValidator.MinimumClientSecretLength Field
Minimum length, in characters, of a generated client secret. A client authenticating with
client_secret_jwt (OpenID Connect Core §9) uses the secret's UTF-8 bytes as the HMAC
key, and RFC 7518 §3.2 requires an HS256 key of at least 32 bytes; a shorter secret cannot
serve that method at all.
public const int MinimumClientSecretLength = 32;Field Value
SecretLengthOptionsValidator.MinimumRandomSecretLength Field
Minimum length, in characters, of an opaque random secret the server issues as a bearer value (authorization code, PAR request URI, session/token/grant identifier). Below this a random token becomes guessable; the value is a hard safety floor, well under every shipped default.
public const int MinimumRandomSecretLength = 16;