IssuerAllowlistStep Class

Requires the "iss" claim to name an issuer this receiver accepts events from. The claim is REQUIRED (RFC 8417 Section 2.2), and running the check before the signature step keeps an unknown issuer's token from costing a key resolution: the signature step's resolver would refuse it anyway, but refusing here names the reason precisely.

public sealed class IssuerAllowlistStep : Abblix.SecurityEvents.Validation.ISecurityCriticalValidator, Abblix.SecurityEvents.Validation.ISecurityEventTokenValidator

Inheritance System.Object → IssuerAllowlistStep

Implements ISecurityCriticalValidator, ISecurityEventTokenValidator

Remarks

The issuer read here is unverified - it decides only whether to PROCEED, and proceeding means verifying a signature against that issuer's keys, so a lie about "iss" buys an attacker nothing: the signature against the claimed issuer's keys is exactly what fails next. Security-critical, because this step is also what keeps that unverified claim from steering the key fetch: with the allowlist gone, a crafted "iss" aims the resolver's outbound request at a network target of the sender's choosing, and the failed signature afterwards is no consolation - the request itself was the prize.

Methods

IssuerAllowlistStep.ValidateAsync(SecurityEventTokenValidationContext, CancellationToken) Method

Checks the token in flight.

public System.Threading.Tasks.ValueTask<Abblix.SecurityEvents.Validation.SecurityEventTokenValidationError?> ValidateAsync(Abblix.SecurityEvents.Validation.SecurityEventTokenValidationContext context, System.Threading.CancellationToken cancellationToken);