ForbidNonceStep Class

Refuses a Logout Token that carries a nonce - step 7 of OpenID Connect Back-Channel Logout 1.0 Section 2.6.

public sealed class ForbidNonceStep : Abblix.SecurityEvents.Validation.ISecurityEventTokenValidator

Inheritance System.Object → ForbidNonceStep

Implements ISecurityEventTokenValidator

Remarks

The prohibition protects the other endpoint, not this one. Section 2.4 says why the claim is banned: a nonce "is prohibited to make a Logout Token syntactically invalid if used in a forged Authentication Response in place of an ID Token". So refusing it here is this receiver keeping its half of an agreement that guards the authorization callback - which is also why the check belongs in every deployment and not only in those worried about their own logout endpoint.

Checked before the signature, on the member's presence, because a malformed nonce marks the token exactly as a well-formed one does and a rejection this cheap should not cost a signature verification.

Methods

ForbidNonceStep.ValidateAsync(SecurityEventTokenValidationContext, CancellationToken) Method

Checks the token in flight.

public System.Threading.Tasks.ValueTask<Abblix.SecurityEvents.Validation.SecurityEventTokenValidationError?> ValidateAsync(Abblix.SecurityEvents.Validation.SecurityEventTokenValidationContext context, System.Threading.CancellationToken cancellationToken);