Security: Enforce tenant-aware issuer validation and enable audience check by default for AAD authentication#49033

Open

rujche wants to merge 27 commits intomainfrom

rujche/main/fix-issue-in-AadJwtIssuerValidator.trustedIssuerRepoValidIssuer

Commits on May 4, 2026

Fix AAD issuer and audience validation defaults
rujche
committed
Update change log
rujche
committed
Address review comments: fix import order, centralize isMultiTenantsApplication, fix changelog link

Copilot
and
rujche
authored

Commits on May 6, 2026

Revert isMultiTenantsApplication to private: not intended as public API

Copilot
and
rujche
authored
Revert static modifier from isMultiTenantsApplication in AadAuthenticationProperties

Copilot
and
rujche
authored
Fix grammar and spacing in UserPrincipalManager audience-mismatch error message

Copilot
and
rujche
authored
Fix critical security vulnerability in AAD Resource Server tenant validation
rujche
committed
Add explicit tenant ID (tid) claim validation
rujche
committed
Simplify tenant ID validation logic and unify error messages
rujche
committed
Update CHANGELOG for AAD resource server security hardening
rujche
committed
Fix test failures by adding tenant-id configuration
rujche
committed
Fix CHANGELOG wording and redundant tests per review feedback

Copilot
and
rujche
authored
Update changelog
rujche
committed
Potential fix for pull request finding

rujche
and
Copilot
authored
Potential fix for pull request finding

rujche
and
Copilot
authored
Update CHANGELOG to document AadAuthenticationFilter audience validation
rujche
committed
Update comment
rujche
committed
Delete comment
rujche
committed
Delete useless empty lines
rujche
committed
Potential fix for pull request finding

rujche
and
Copilot
authored
Potential fix for pull request finding

rujche
and
Copilot
authored
Potential fix for pull request finding

rujche
and
Copilot
authored
Fix test assertions to match actual validateTenantId error message

Copilot
and
rujche
authored
Trim tenant-id before validation and use in validators to prevent whitespace bypass

Copilot
and
rujche
authored
Add test for whitespace-padded reserved tenant-id rejection after trimming

Copilot
and
rujche
authored
Trim tenant-id in jwtDecoder() before building AadAuthorizationServerEndpoints

Copilot
and
rujche
authored
Extract getTrimmedTenantId helper to eliminate duplicate trim logic

Copilot
and
rujche
authored

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Security: Enforce tenant-aware issuer validation and enable audience check by default for AAD authentication#49033

Security: Enforce tenant-aware issuer validation and enable audience check by default for AAD authentication#49033
rujche wants to merge 27 commits intomainfrom
rujche/main/fix-issue-in-AadJwtIssuerValidator.trustedIssuerRepoValidIssuer

Commits on May 4, 2026

Fix AAD issuer and audience validation defaults

Update change log

Address review comments: fix import order, centralize isMultiTenantsApplication, fix changelog link

Commits on May 6, 2026

Revert isMultiTenantsApplication to private: not intended as public API

Revert static modifier from isMultiTenantsApplication in AadAuthenticationProperties

Fix grammar and spacing in UserPrincipalManager audience-mismatch error message

Fix critical security vulnerability in AAD Resource Server tenant validation

Add explicit tenant ID (tid) claim validation

Simplify tenant ID validation logic and unify error messages

Update CHANGELOG for AAD resource server security hardening

Fix test failures by adding tenant-id configuration

Fix CHANGELOG wording and redundant tests per review feedback

Update changelog

Potential fix for pull request finding

Potential fix for pull request finding

Update CHANGELOG to document AadAuthenticationFilter audience validation

Update comment

Delete comment

Delete useless empty lines

Potential fix for pull request finding

Potential fix for pull request finding

Potential fix for pull request finding

Fix test assertions to match actual validateTenantId error message

Trim tenant-id before validation and use in validators to prevent whitespace bypass

Add test for whitespace-padded reserved tenant-id rejection after trimming

Trim tenant-id in jwtDecoder() before building AadAuthorizationServerEndpoints

Extract getTrimmedTenantId helper to eliminate duplicate trim logic