Class InputLengthRestrictions
- Namespace
- Fdyay.IdentityServer.Configuration
- Assembly
- Fdyay.IdentityServer.Core.dll
How long each protocol parameter this server reads may be.
public class InputLengthRestrictions- Inheritance
-
InputLengthRestrictions
- Inherited Members
Remarks
Mostly an abuse control: every value here arrives from a caller, several of them unauthenticated, and each is then split, compared, hashed, stored or logged. A bound is the cheapest thing that stops any of those being asked to do unbounded work.
CodeVerifierMinLength is the exception, and it is not about abuse at all. RFC 7636 §4.1
requires a code_verifier of 43 to 128 characters because PKCE's whole protection is that an attacker
holding an intercepted authorization code cannot produce the verifier. That attacker also holds the
code_challenge — it travelled in the authorization request — so a short verifier is brute-forced
offline and the code redeemed. The floor is what makes the search infeasible.
Every property here is enforced. A limit that nothing reads would be a setting an operator could tune while the request it names went on unbounded, which is the shape §1 of the parity matrix exists to remove — so parameters this server does not yet bound are absent rather than present and ignored.
Properties
AcrValues
Maximum length of acr_values. Defaults to 300.
public int AcrValues { get; set; }Property Value
AuthenticationRequestId
The longest CIBA auth_req_id accepted at the token endpoint. Defaults to 100; a longer one is invalid_grant.
public int AuthenticationRequestId { get; set; }Property Value
AuthorizationCode
The longest authorization code accepted at the token endpoint. Defaults to 100; a longer one is invalid_grant, before the store is asked.
public int AuthorizationCode { get; set; }Property Value
BindingMessage
Maximum length of a CIBA binding_message. Defaults to 64.
public int BindingMessage { get; set; }Property Value
Remarks
Bounded by human patience rather than by storage: it exists to be read out and compared by a person on two devices, and a message nobody finishes comparing is a ceremony everyone learns to click through.
ClientId
Maximum length of client_id. Defaults to 100.
public int ClientId { get; set; }Property Value
ClientNotificationToken
The longest client_notification_token accepted. Defaults to 1024.
public int ClientNotificationToken { get; set; }Property Value
Remarks
Client-supplied and stored, so it is bounded like every other string a client sends. CIBA Core §7.1 asks for at least 128 bits of entropy and sets no ceiling, so the ceiling here is only about not storing an arbitrary amount of someone else's data: anything a client can reasonably mint fits far inside it.
ClientSecret
The longest client secret read from the Authorization header or the form. Defaults to 100.
public int ClientSecret { get; set; }Property Value
Remarks
A longer one is not a credential: the parser reads nothing, as Duende's does, and the request is answered as one
with no client authentication. The Authorization header as a whole may be no longer than the base64 of a
client id and secret at their limits.
CodeChallengeMaxLength
Maximum length of code_challenge. Defaults to 128.
public int CodeChallengeMaxLength { get; set; }Property Value
CodeChallengeMinLength
Minimum length of code_challenge (RFC 7636 §4.2). Defaults to 43.
public int CodeChallengeMinLength { get; set; }Property Value
CodeVerifierMaxLength
Maximum length of code_verifier. Defaults to 128.
public int CodeVerifierMaxLength { get; set; }Property Value
CodeVerifierMinLength
Minimum length of code_verifier (RFC 7636 §4.1). Defaults to 43.
public int CodeVerifierMinLength { get; set; }Property Value
Remarks
Lowering this weakens PKCE for every client, and lowering it far enough removes PKCE's protection entirely while leaving every part of the exchange looking correct. It is settable because the specification names a number and a host may have to meet an older client, not because it is a knob.
DPoPKeyThumbprint
The longest dpop_jkt accepted at the authorize endpoint. Defaults to 100.
public int DPoPKeyThumbprint { get; set; }Property Value
Remarks
A SHA-256 JWK thumbprint is 43 characters.
DPoPProofToken
The longest DPoP proof accepted, at the token and pushed authorization endpoints. Defaults to 4000.
public int DPoPProofToken { get; set; }Property Value
Remarks
Duende's default, measured from its 8.0.1 package. Checked before the proof is parsed, so a client cannot make this server verify a signature over an arbitrary amount of input; a proof is a header, a key and a few claims.
DeviceCode
The longest device_code accepted at the token endpoint. Defaults to 100.
public int DeviceCode { get; set; }Property Value
Remarks
Duende's default, measured from its 8.0.1 package: a longer one is invalid_grant, before the store is asked.
GrantType
The longest grant_type accepted at the token endpoint. Defaults to 100; a longer one is unsupported_grant_type.
public int GrantType { get; set; }Property Value
IdTokenHint
The longest id_token_hint accepted. Defaults to 4000.
public int IdTokenHint { get; set; }Property Value
Remarks
Checked before the token is parsed, so a client cannot make this server verify a signature over an arbitrary amount of input. Generous because an identity token carries whatever profile claims a client is entitled to, and one this server signed should never be refused for being this server's own size.
Jwt
The longest request object accepted, by value or fetched, and the longest signed CIBA request. Defaults to 51200.
public int Jwt { get; set; }Property Value
Remarks
Duende's default, measured from its 8.0.1 package, where it bounds the handler that reads the object.
LoginHint
Maximum length of login_hint. Defaults to 100.
public int LoginHint { get; set; }Property Value
LoginHintToken
The longest CIBA login_hint_token accepted. Defaults to 4000.
public int LoginHintToken { get; set; }Property Value
Remarks
Duende's default, measured from its 8.0.1 package: a longer one is invalid_request.
Nonce
Maximum length of nonce. Defaults to 300.
public int Nonce { get; set; }Property Value
RedirectUri
Maximum length of redirect_uri. Defaults to 400.
public int RedirectUri { get; set; }Property Value
RefreshToken
The longest refresh_token accepted at the token endpoint. Defaults to 100; a longer one is invalid_grant, before the store is asked.
public int RefreshToken { get; set; }Property Value
ResourceIndicator
The longest resource indicator accepted (RFC 8707). Defaults to 512.
public int ResourceIndicator { get; set; }Property Value
Remarks
Duende's default, measured from its 8.0.1 package; an API's URI has no reason to come near it.
Scope
Maximum length of scope, the whole space-delimited list. Defaults to 300.
public int Scope { get; set; }Property Value
State
Maximum length of state. Defaults to 2000.
public int State { get; set; }Property Value
Remarks
The most generous bound here, because state is the one parameter clients legitimately pack: it
is theirs, opaque to this server, and often carries an encoded return context. It is also the only one
echoed back, which is why exceeding it is answered without a redirect — see the authorize validator.
TokenHandle
The longest reference-token handle accepted wherever an access token is validated. Defaults to 100.
public int TokenHandle { get; set; }Property Value
Remarks
A JWT is held to Jwt instead. Either too long is invalid_token before anything is looked up or verified.
UiLocale
The longest ui_locales accepted at the authorize endpoint. Defaults to 100.
public int UiLocale { get; set; }Property Value
UserCode
The longest CIBA user_code accepted. Defaults to 100.
public int UserCode { get; set; }Property Value
Remarks
CIBA's only — the device flow's user code is a different thing under the same name, one this server generates rather than one a client sends. A user code is a PIN or a password, so the bound is about not handing a host's validator an arbitrary amount of input to compare, not about what a real one looks like.