ExpAbsenceStep Class

Requires the claims to carry no "exp". Its absence is the wall between a SET and the ID and access tokens an attacker would substitute one for (RFC 8417 Sections 4.1 and 4.2), so a token carrying it is treated as another kind of JWT in a SET's clothing.

public sealed class ExpAbsenceStep : Abblix.SecurityEvents.Validation.ISecurityCriticalValidator, Abblix.SecurityEvents.Validation.ISecurityEventTokenValidator

Inheritance System.Object → ExpAbsenceStep

Implements ISecurityCriticalValidator, ISecurityEventTokenValidator

Remarks

The check is on the member's PRESENCE, not its parsed value: a malformed "exp" is exactly as much a marker of a non-SET as a well-formed one, and a presence check cannot be fooled by a value the parser fails to read. This is stricter than RFC 8417 Section 2.2's NOT RECOMMENDED, deliberately: the builder on the transmitting side refuses to write the claim, and a receiver this strict keeps the confusion wall standing even for issuers using other toolkits.

Methods

ExpAbsenceStep.ValidateAsync(SecurityEventTokenValidationContext, CancellationToken) Method

Checks the token in flight.

public System.Threading.Tasks.ValueTask<Abblix.SecurityEvents.Validation.SecurityEventTokenValidationError?> ValidateAsync(Abblix.SecurityEvents.Validation.SecurityEventTokenValidationContext context, System.Threading.CancellationToken cancellationToken);