Implement RFC 9207 issuer validation in ClientOAuthProvider (#1605)

This commit is contained in:
Mike Kistler 2026-07-23 08:01:22 -07:00 • committed by GitHub
commit 4aade88558
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -12,7 +12,8 @@ internal sealed class OAuthServerMetadata
/// REQUIRED. The authorization server's issuer identifier, which is a URL that uses the "https" scheme and has no query or fragment components.
/// </summary>
[JsonPropertyName("issuer")]
public required string Issuer { get; init; }
[JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
public string? Issuer { get; init; }
/// <summary>
/// Gets or sets the authorization endpoint URL.
@ -178,4 +179,11 @@ internal sealed class OAuthServerMetadata
[JsonPropertyName("client_id_metadata_document_supported")]
[JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
public bool? ClientIdMetadataDocumentSupported { get; init; }
/// <summary>
/// Gets or sets a value indicating whether authorization responses contain an issuer parameter.
/// </summary>
[JsonPropertyName("authorization_response_iss_parameter_supported")]
[JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
public bool? AuthorizationResponseIssParameterSupported { get; init; }
}