-
Notifications
You must be signed in to change notification settings - Fork 68
Ensure ClaimsPrincipal.Current is set if user changes #631
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
The existing setup would only set Current to the existing user. Some scenarios seem to invoke at other times, so this uses the IRequestUserFeature to ensure that any updates to the user will be mirrored to the ClaimsUser.Current
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR updates the System.Web Adapters to ensure ClaimsPrincipal.Current is properly synchronized with user changes throughout the request lifecycle. The implementation replaces the previous approach of setting Current only at request initialization with a feature-based system that mirrors any user updates to ClaimsPrincipal.Current.
Key changes:
- Introduced
IRequestUserFeature.EnableStaticAccessors()method andSystemWebAdaptersOptions.EnableStaticUserAccessorsproperty for opt-in static accessor management - Refactored middleware architecture by splitting
RegisterAdapterFeaturesMiddlewareinto separateRequestUserFeaturesMiddleware,RequestFeaturesMiddleware, andResponseFeaturesMiddlewarecomponents - Added
CurrentPrincipalMiddlewareto handle endpoint-specific static accessor enabling viaSetThreadCurrentPrincipalAttribute
Reviewed Changes
Copilot reviewed 23 out of 24 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| src/Microsoft.AspNetCore.SystemWebAdapters/SystemWebAdaptersOptions.cs | Adds configuration option for enabling static user accessors |
| src/Microsoft.AspNetCore.SystemWebAdapters/Adapters/Features/IRequestUserFeature.cs | Adds method to enable static accessor synchronization |
| src/Microsoft.AspNetCore.SystemWebAdapters/HttpContext.cs | Updates user setter to use required feature instead of extension method |
| src/Microsoft.AspNetCore.SystemWebAdapters/HttpRequest.cs | Updates LogonUserIdentity to use required feature directly |
| src/Microsoft.AspNetCore.SystemWebAdapters/Internal/RequestUserExtensions.cs | File deleted - functionality moved to middleware |
| src/Microsoft.AspNetCore.SystemWebAdapters.CoreServices/SystemWebAdaptersExtensions.cs | Adds extension method for configuring static accessors and updates middleware registration |
| src/Microsoft.AspNetCore.SystemWebAdapters.CoreServices/Middleware/RequestUserFeaturesMiddleware.cs | New middleware implementing user feature with static accessor synchronization |
| src/Microsoft.AspNetCore.SystemWebAdapters.CoreServices/Middleware/RequestFeaturesMiddleware.cs | New middleware handling request-related features |
| src/Microsoft.AspNetCore.SystemWebAdapters.CoreServices/Middleware/ResponseFeaturesMiddleware.cs | New middleware handling response-related features |
| src/Microsoft.AspNetCore.SystemWebAdapters.CoreServices/Middleware/CurrentPrincipalMiddleware.cs | New middleware enabling static accessors based on endpoint metadata |
| src/Microsoft.AspNetCore.SystemWebAdapters.CoreServices/RegisterAdapterFeaturesMiddleware.cs | File deleted - split into separate middleware components |
| src/Microsoft.AspNetCore.SystemWebAdapters.CoreServices/CurrentPrincipalMiddleware.cs | File deleted - replaced by new middleware implementation |
| Multiple middleware files | Namespace updated from Microsoft.AspNetCore.SystemWebAdapters to Microsoft.AspNetCore.SystemWebAdapters.Middleware |
| test/Microsoft.AspNetCore.SystemWebAdapters.Tests/HttpContextTests.cs | Adds test feature setup to ensure proper user feature behavior in tests |
| test/Microsoft.AspNetCore.SystemWebAdapters.E2E.Tests/RemoteAuthIdentityTests.cs | Adds validation for ClaimsPrincipal.Current behavior and refactors endpoint handling |
| test/Microsoft.AspNetCore.SystemWebAdapters.CoreServices.Tests/HttpRuntimeIntegrationTests.cs | Migrates tests from host builder to WebApplication pattern |
| test/Microsoft.AspNetCore.SystemWebAdapters.CoreServices.Tests/SelfHostedTestBase.cs | File deleted - test base class no longer needed |
| samples/AuthRemoteIdentity/AuthRemoteIdentityCore/Program.cs | Adds endpoint demonstrating ClaimsPrincipal.Current usage and corrects middleware order |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
The existing setup would only set Current to the existing user. Some scenarios seem to invoke at other times, so this uses the IRequestUserFeature to ensure that any updates to the user will be mirrored to the ClaimsUser.Current