Class DataProtectionGrantDataProtector

Namespace

Fdyay.IdentityServer.Services

Assembly

Fdyay.IdentityServer.Core.dll

Supports all classes in the .NET class hierarchy and provides low-level services to derived classes. This is the ultimate base class of all .NET classes; it is the root of the type hierarchy.

public sealed class DataProtectionGrantDataProtector : IGrantDataProtector

Inheritance

object

DataProtectionGrantDataProtector

Implements

IGrantDataProtector

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Uses the host's own data protection ring, so the keys that protect grants are the keys the host already rotates and backs up — and a grant written by one instance is readable by another sharing that ring, which is the same requirement the signing keys and the anti-forgery tokens already place on it.

Constructors

DataProtectionGrantDataProtector(IEnumerable<IDataProtectionProvider>, IOptions<IdentityServerOptions>)

Takes the data protection providers registered, rather than one, because the dependency is needed on one path only.

public DataProtectionGrantDataProtector(IEnumerable<IDataProtectionProvider> providers, IOptions<IdentityServerOptions> options)

Parameters

providers IEnumerable<IDataProtectionProvider>

options IOptions<IdentityServerOptions>

Remarks

A constructor parameter of IDataProtectionProvider would make the switch unreachable. This type is resolved to build the grant store, which every host resolves, so a missing provider would fail at the container rather than at the write — and a host that had set DataProtectData to false could not start, despite having asked for nothing that needs a provider. Core cannot register one itself: it references only the data protection abstractions, deliberately, so that the implementation comes from the ASP.NET Core shared framework rather than the standalone package. An empty enumerable is how the container says "nobody registered one", which is a question that can be asked without failing.

Methods

Protect(string)

Protects data for storage, or returns it unchanged when switched off.

public string Protect(string data)

Parameters

data string

Returns

string

Unprotect(string)

Returns the original value, whether the stored one was protected or not.

public string Unprotect(string data)

Parameters

data string

Returns

string

Remarks

The option is deliberately not read here. A store holding both shapes at once is the ordinary state during an upgrade and after a host changes its mind, and a reader that consulted the switch would answer correctly for one shape and throw for the other.