SecurityEventTokenValidationOptions Class
What one validation run expects of the token: the per-call half of the receiver's configuration, as opposed to the pipeline composition and key resolution, which are wired once.
public record SecurityEventTokenValidationOptions : System.IEquatable<Abblix.SecurityEvents.Validation.SecurityEventTokenValidationOptions>Inheritance System.Object → SecurityEventTokenValidationOptions
Derived
↳ BackChannelLogoutValidationOptions
Implements System.IEquatable<SecurityEventTokenValidationOptions>
Properties
SecurityEventTokenValidationOptions.ExpectedAudience Property
The audience value under which this receiver expects to be named in the "aud" claim. Required by the default pipeline's audience step; a profile that removes that step may leave it null.
public string? ExpectedAudience { get; init; }Property Value
SecurityEventTokenValidationOptions.ExpectedIssuers Property
The issuers this receiver accepts events from. An empty set accepts nobody - the safe reading of an unconfigured receiver - and the issuer step reports any other issuer as unknown.
public System.Collections.Generic.IReadOnlyCollection<string> ExpectedIssuers { get; init; }Property Value
System.Collections.Generic.IReadOnlyCollection<System.String>
SecurityEventTokenValidationOptions.IssuedAtTolerance Property
How far a token's "iat" may lie from the receiver's clock, in either direction: the same window forgives clock skew for a token from the near future and bounds staleness for one from the past. The bound matters beyond hygiene - a replay cache tracking received "jti" values (RFC 8417 Section 2.2 names that use) can evict entries older than the window instead of remembering every identifier forever, because anything older fails here first.
public System.TimeSpan IssuedAtTolerance { get; init; }Property Value
SecurityEventTokenValidationOptions.ReplayRetention Property
How long past a token's issue time its identifier stays in the replay cache. It must cover IssuedAtTolerance with a margin, because an identifier forgotten while its token still passes the freshness window above is an identifier that token can replay on. The default doubles the default tolerance, and raising one without the other is the mistake this pairing is written side by side to prevent.
public System.TimeSpan ReplayRetention { get; init; }