Need to check for 'null-or-empty' issuer signing keys (#2057)

AzureAD · Apr 19, 2023 · 3d91c43 · 3d91c43
1 parent ceb10b1
commit 3d91c43
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/Microsoft.IdentityModel.JsonWebTokens/JsonWebTokenHandler.cs b/src/Microsoft.IdentityModel.JsonWebTokens/JsonWebTokenHandler.cs
@@ -1547,7 +1547,7 @@ private static JsonWebToken ValidateSignature(JsonWebToken jwtToken, TokenValida
                 }
             }
 
-            if (keys == null && validationParameters.TryAllIssuerSigningKeys)
+            if (validationParameters.TryAllIssuerSigningKeys && keys.IsNullOrEmpty())
             {
                 // control gets here if:
                 // 1. User specified delegate: IssuerSigningKeyResolver returned null