You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
NET stores 'string' type as UTF16, while an incoming JWT is UTF8. Currently the inefficiency is that we convert the JWT values into UTF16, store them, then preform validation.
Wherever (TokenValidationParameters) user-provided input (ex. audience, issuer) exists, create an associated internal ReadOnlySpan property of Utf8.
When reading values from an incoming token, validate the values immediately after reading them and fail fast if validation fails.
When doing the validation use the Utf8-valued property for comparison rather than a string.
There could be a large number of custom claims in a JWT, meaning we can't create a property for each. Add an extensibility point, like a user-passed in delegate, which would dynamically validate those custom claims.
Currently on get, the public properties retrieve the value from the payload. We should instead ToString() the aforementioned Utf8 properties on demand
NET stores 'string' type as UTF16, while an incoming JWT is UTF8. Currently the inefficiency is that we convert the JWT values into UTF16, store them, then preform validation.
Benchmark of CompareUtf8 vs CompareUtf16:
"What we see is about a 25% gain in performance and a greater than 50% reduction in memory."
Related to #2581, #2583.
The text was updated successfully, but these errors were encountered: