[release/11.0-rc1] Extract IsAuthenticated helper method - #68658
Merged
wtgodbe merged 3 commits intoAug 21, 2026
Conversation
Co-authored-by: Youssef1313 <31348972+Youssef1313@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Youssef1313 <31348972+Youssef1313@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Youssef1313 <31348972+Youssef1313@users.noreply.github.com>
Copilot created this pull request from a session on behalf of
Youssef1313
August 20, 2026 04:28
View session
Youssef1313
changed the title
Youssef1313
marked this pull request as ready for review
August 20, 2026 04:41
Youssef1313
requested review from
a team,
BrennanConroy,
Youssef1313,
cincuranet,
halter73 and
rokonec
as code owners
August 20, 2026 04:41
Contributor
There was a problem hiding this comment.
Pull request overview
This backport extracts a shared SecurityHelper.IsAuthenticated(ClaimsPrincipal?) helper that matches DenyAnonymousAuthorizationRequirement’s aggregate authentication semantics (any authenticated identity, not just the primary identity), and adopts it in multiple call sites that previously checked only User.Identity.
Changes:
- Add
SecurityHelper.IsAuthenticatedhelper to centralize authenticated-principal semantics. - Update Authorization, Output Caching, and Blazor Server revalidation logic to use the helper (ensuring non-primary authenticated identities are treated as authenticated).
- Add/extend unit tests to cover the helper and the updated Output Caching behavior.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| src/Shared/test/Shared.Tests/SecurityHelperTests.cs | Adds unit tests for the new SecurityHelper.IsAuthenticated helper, including non-primary identity behavior. |
| src/Shared/SecurityHelper/SecurityHelper.cs | Introduces the IsAuthenticated(ClaimsPrincipal?) helper with authorization-matching semantics. |
| src/Security/Authorization/Core/src/Microsoft.AspNetCore.Authorization.csproj | Links the shared SecurityHelper source into the Authorization assembly. |
| src/Security/Authorization/Core/src/DenyAnonymousAuthorizationRequirement.cs | Replaces inline principal-authenticated logic with SecurityHelper.IsAuthenticated. |
| src/Middleware/OutputCaching/test/OutputCachePolicyProviderTests.cs | Adds tests ensuring output caching is disallowed for principals authenticated via any identity. |
| src/Middleware/OutputCaching/src/Policies/DefaultPolicy.cs | Uses SecurityHelper.IsAuthenticated when deciding cache eligibility/storage for authenticated users. |
| src/Middleware/OutputCaching/src/Microsoft.AspNetCore.OutputCaching.csproj | Links the shared SecurityHelper source into the OutputCaching assembly. |
| src/Components/Server/src/Microsoft.AspNetCore.Components.Server.csproj | Links the shared SecurityHelper source into the Components Server assembly. |
| src/Components/Server/src/Circuits/RevalidatingServerAuthenticationStateProvider.cs | Uses SecurityHelper.IsAuthenticated to determine whether to enter the revalidation loop. |
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
BrennanConroy
approved these changes
Aug 20, 2026
wtgodbe
approved these changes
Aug 21, 2026
This was referenced Aug 21, 2026
wtgodbe
added a commit
that referenced
this pull request
Aug 22, 2026
* [SignalR] Reject duplicate SignalR upload stream IDs (#68525) (#68638) * Reject duplicate SignalR upload stream IDs * Simplify upload stream ownership cleanup * Avoid upload stream ownership allocations * Simplify upload stream registration ownership * Defer upload stream reader creation * Dispose cancellation source after binding failure * Reuse upload stream test helper --------- Co-authored-by: Javier Calvarro Nelson <jacalvar@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 82e97f5a-a052-4dbe-9cf1-b62f45cf7ee2 * Honor all sign-in confirmation requirements after registration (#68631) (#68655) Co-authored-by: Brennan <brecon@microsoft.com> * Preserve BadHttpRequestException status codes (#68632) (#68649) * Preserve BadHttpRequestException status codes * Preserve exception handler 404 safeguard --------- Co-authored-by: Stephen Halter <halter73@gmail.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * SignInManager: return SignInResult.Failed for expired passkey session challenge (#67539) (#68654) Co-authored-by: Grant Totinov <granttotinov604@gmail.com> * Don't apply the CSRF verdict to remote authentication callbacks (#68669) * Don't apply the CSRF verdict to remote authentication callbacks A remote provider's callback (OIDC response_mode=form_post, WS-Federation) is a cross-site form POST by protocol design, so the auto-injected CSRF protection records an invalid IAntiforgeryValidationFeature verdict for it. The handler then throws while reading its own callback body, before any of its events can run, so apps have no way to opt out. Suppress the verdict while a remote handler owns the request, and restore it if the handler declines so the rest of the pipeline still sees it. Fixes #68666 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: cb987098-3301-465b-9a3d-2e63aabf43bd * test both antiforgery & csrf --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: cb987098-3301-465b-9a3d-2e63aabf43bd * Use model display names in Blazor input parsing errors (#68667) (#68688) * Use display attributes in input parsing errors * Address test coverage feedback from review. * Apply dedup cleanup from feedback. Co-authored-by: Ilona Tomkowicz <32700855+ilonatommy@users.noreply.github.com> * [release/11.0-rc1] Extract IsAuthenticated helper method (#68658) * Extract IsAuthenticated helper method Co-authored-by: Youssef1313 <31348972+Youssef1313@users.noreply.github.com> * Reorder using Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Youssef1313 <31348972+Youssef1313@users.noreply.github.com> * Use SecurityHelper for authentication revalidation Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Youssef1313 <31348972+Youssef1313@users.noreply.github.com> --------- Co-authored-by: Youssef1313 <youssefvictor00@gmail.com> Co-authored-by: Youssef1313 <31348972+Youssef1313@users.noreply.github.com> Co-authored-by: Milos Kotlar <kotlarmilos@gmail.com> * Fix InitialItemIndex viewport underfill for small items in big container or on window resize (#67936) (#68689) Co-authored-by: Ilona Tomkowicz <32700855+ilonatommy@users.noreply.github.com> * fix nullable<union> for openapi gen (#68665) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Javier Calvarro Nelson <jacalvar@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Brennan <brecon@microsoft.com> Co-authored-by: Stephen Halter <halter73@gmail.com> Co-authored-by: Grant Totinov <granttotinov604@gmail.com> Co-authored-by: Korolev Dmitry <dmkorolev@microsoft.com> Co-authored-by: Ilona Tomkowicz <32700855+ilonatommy@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Youssef1313 <youssefvictor00@gmail.com> Co-authored-by: Youssef1313 <31348972+Youssef1313@users.noreply.github.com> Co-authored-by: Milos Kotlar <kotlarmilos@gmail.com> Co-authored-by: William Godbe <wigodbe@microsoft.com> Copilot-Session: 82e97f5a-a052-4dbe-9cf1-b62f45cf7ee2 Copilot-Session: cb987098-3301-465b-9a3d-2e63aabf43bd
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backporting #68645 to release/11.0-rc1