DefaultSecurityEventTokenVerifier Class
The out-of-the-box verifier: signature verification through the Abblix JWT core, with keys from the issuer resolver.
public sealed class DefaultSecurityEventTokenVerifier : Abblix.SecurityEvents.Abstractions.ISecurityEventTokenVerifierInheritance System.Object → DefaultSecurityEventTokenVerifier
Implements ISecurityEventTokenVerifier
Remarks
The core is asked for exactly the signature - a signed token, verified against the issuer's keys - and nothing more: issuer allowlisting, audience, freshness and typing are pipeline steps, and letting the core re-check them would report their failures in the wrong vocabulary from the wrong place. An issuer the resolver yields no keys for is reported as a key miss rather than a bad signature, because a refetch may heal the former and never the latter.
Constructors
DefaultSecurityEventTokenVerifier(IJsonWebTokenValidator, IIssuerKeyResolver, string[]) Constructor
The out-of-the-box verifier: signature verification through the Abblix JWT core, with keys from the issuer resolver.
public DefaultSecurityEventTokenVerifier(Abblix.Jwt.IJsonWebTokenValidator validator, Abblix.SecurityEvents.Abstractions.IIssuerKeyResolver keyResolver, string[] allowedAlgorithms);Parameters
validator IJsonWebTokenValidator
The JWT core's validator.
keyResolver IIssuerKeyResolver
The receiver's key trust.
allowedAlgorithms System.String[]
What this deployment will accept a signature under. Stated rather than inherited: without it the accepted set is whatever the validator happens to permit, which is a policy nobody wrote and nobody can read off the configuration.
Remarks
The core is asked for exactly the signature - a signed token, verified against the issuer's keys - and nothing more: issuer allowlisting, audience, freshness and typing are pipeline steps, and letting the core re-check them would report their failures in the wrong vocabulary from the wrong place. An issuer the resolver yields no keys for is reported as a key miss rather than a bad signature, because a refetch may heal the former and never the latter.
Methods
DefaultSecurityEventTokenVerifier.VerifyAsync(string, string, CancellationToken) Method
Verifies the token's signature.
public System.Threading.Tasks.Task<Abblix.Utils.Result<Abblix.Jwt.JsonWebToken,Abblix.SecurityEvents.Validation.SecurityEventTokenValidationError>> VerifyAsync(string compactToken, string? keyId=null, System.Threading.CancellationToken cancellationToken=default(System.Threading.CancellationToken));Parameters
compactToken System.String
The token as received, in compact serialization.
keyId System.String
The "kid" the token's header names, when the caller has already parsed it - the signature step has - so a caching key resolver can recognise a rollover without re-parsing the token.
cancellationToken System.Threading.CancellationToken
Cancels key retrieval mid-flight.
Implements VerifyAsync(string, string, CancellationToken)
Returns
System.Threading.Tasks.Task<Abblix.Utils.Result<JsonWebToken,SecurityEventTokenValidationError>>
The parsed token on success - claims now carrying the issuer's authority - or the error a
receiver branches on.