Add token binding to MicrosoftIdentityMessageHandler by cpp11nullptr · Pull Request #3743 · AzureAD/microsoft-identity-web

cpp11nullptr · 2026-03-04T17:20:37Z

No description provided.

…andler-with-token-binding

jmprieur

There are a couple of things to improve:

the RequiredService seems inconsistent with the option. Either use GetService or explain why required is fine. I think it's a breaking change, personally. you don't want to break Aspire!!
Fragile code that can be improved
+some questions/remarks

bgavrilMS · 2026-03-05T17:42:26Z

@tlupes - this is related to pure mTLS option, a review from you would be good.

tlupes · 2026-03-05T22:04:52Z

@tlupes - this is related to pure mTLS option, a review from you would be good.

It looks very similar to how DownstreamApi works, which means it should be easy to transfer over. Centralizing the logic would make things easier.

…oken-binding' of https://github.com/AzureAD/microsoft-identity-web into iepoly/extend-microsoft-identity-message-handler-with-token-binding

…soft-identity-message-handler-with-token-binding

cpp11nullptr · 2026-03-23T15:49:29Z

@tlupes - this is related to pure mTLS option, a review from you would be good.

It looks very similar to how DownstreamApi works, which means it should be easy to transfer over. Centralizing the logic would make things easier.

(replied in other comment)

jmprieur

LGTM
I left a few comments worth looking at.

jmprieur

Thanks for addressing the feedback

bgavrilMS · 2026-03-26T10:18:48Z

-                    UserFlow = originalOptions.AcquireTokenOptions.UserFlow
-                };
+                challengeOptions.AcquireTokenOptions.Claims = challengeClaims;
+                challengeOptions.AcquireTokenOptions.ForceRefresh = true;


This isn't needed. MSAL would do the right thing. Functioanlly it's ok, except that some telemetry will go haywire.

Updated [Microsoft.Identity.Web](https://github.com/AzureAD/microsoft-identity-web) from 4.7.0 to 4.10.0. <details> <summary>Release notes</summary> _Sourced from [Microsoft.Identity.Web's releases](https://github.com/AzureAD/microsoft-identity-web/releases)._ ## 4.10.0 ### New features - Add `WithExtraBodyParameters` fluent API for attaching extra body parameters to token acquisition requests. See [#3819](AzureAD/microsoft-identity-web#3819). - Add `IConfidentialClientApplicationProvider` extensibility interface and `CachePartitionKey` support for silent token acquisition. See [#3822](AzureAD/microsoft-identity-web#3822). ### Bug fixes - Redirect URI sanitization in authorization scenarios; centralize redirect URI validation in a shared helper. See [#3825](AzureAD/microsoft-identity-web#3825). - Reject dSTS-shaped `Authority` values with a clearer exception, steering users to use `Instance` + `TenantId` instead. See [#3805](AzureAD/microsoft-identity-web#3805). - Improve regex handling and adding length/timeout safeguards for SameSite User Agent. See [#3811](AzureAD/microsoft-identity-web#3811). ### Behavior changes - **B2C OpenID Connect event handler: LRU cache for issuer address.** Issuer address lookups in the B2C OIDC event handler are now cached with an LRU cache, improving performance for repeated lookups. See [#3821](AzureAD/microsoft-identity-web#3821). ### Dependencies updates - Update MSAL.NET to 4.84.1. See [#3822](AzureAD/microsoft-identity-web#3822). - Pin `Microsoft.Kiota.Abstractions` to 1.22.0 for GraphServiceClient. See [#3817](AzureAD/microsoft-identity-web#3817). - Bump `uuid` and `@azure/msal-node` in SidecarAdapter TypeScript test app. See [#3826](AzureAD/microsoft-identity-web#3826). - Bump `qs` in SidecarAdapter TypeScript test app. See [#3829](AzureAD/microsoft-identity-web#3829). ## 4.9.0 ### New features - **Sidecar: per-route override gating.** New `Sidecar:AllowOverrides` configuration section provides explicit, per-route control over whether `optionsOverride.*` query-string parameters are honored. Authenticated routes default to allowing overrides (preserving existing behavior); unauthenticated routes default to rejecting them. `optionsOverride.BaseUrl` is unconditionally rejected on all routes as a hardening measure. See [#3794](AzureAD/microsoft-identity-web#3794). ### Bug fixes - Fix `AccountController.Challenge` redirect URI validation to reject percent-encoded protocol-relative bypasses (`%2F%2F`, `%5C%2F`, etc.) that could be decoded by misconfigured reverse proxies. See [#3792](AzureAD/microsoft-identity-web#3792). ### Behavior changes - **DownstreamApi: reserved header filtering.** Headers supplied via `DownstreamApiOptions.ExtraHeaderParameters` whose names match reserved HTTP headers (`Authorization`, `Host`, `Content-Length`, `Proxy-Authorization`, `Sec-*`, `Proxy-*`, etc.) or duplicate a header the library already set are now silently skipped. A warning-level log entry (`ReservedHeaderIgnored` / `DuplicateHeaderIgnored`) is emitted so operators can spot misconfigurations. No exception is thrown. See [#3793](AzureAD/microsoft-identity-web#3793). ### Dependencies updates - **Update Azure.Identity 1.11.4 → 1.17.2 and establish Microsoft.Extensions.\* 8.0.x minimum on older TFMs.** Azure.Identity 1.17.2 (sovereign-cloud fixes) pulls in Azure.Core 1.50.0, which introduces a transitive dependency on `Microsoft.Extensions.DependencyInjection.Abstractions` 8.0.2 on non-framework-coupled TFMs (net462, net472, netstandard2.0). This caused a `CS0433` type collision with the previously-pinned `Microsoft.Extensions.DependencyInjection` 2.1.0. Rather than patch individual packages, the entire `Microsoft.Extensions.*` stack on these older TFMs has been bumped to 8.0.x, closing several 5-year version gaps and aligning with the net8.0 baseline. **If your application targets net462, net472, or netstandard2.0**, your resolved `Microsoft.Extensions.*` versions will increase (e.g., `Extensions.Http` 3.1.3 → 8.0.0, `Extensions.DependencyInjection` 2.1.0 → 8.0.0, `Extensions.Caching.Memory` 2.1.0/6.0.2 → 8.0.1). Applications already targeting net8.0+ are unaffected. See [#3787](AzureAD/microsoft-identity-web#3787). - Bump `System.Text.Json` 8.0.5 → 8.0.6 (CVE-2024-43485). See [#3787](AzureAD/microsoft-identity-web#3787). - Bump `Microsoft.AspNetCore.DataProtection` to 10.0.7 for CVE fix on net10.0. See [#3796](AzureAD/microsoft-identity-web#3796). - Bump `OpenTelemetry.Exporter.OpenTelemetryProtocol` 1.14.0 → 1.15.3. See [#3788](AzureAD/microsoft-identity-web#3788). **Full Changelog**: AzureAD/microsoft-identity-web@4.8.0...4.9.0 ## 4.8.0 ## What's Changed * Bump flatted from 3.3.3 to 3.4.2 in /tests/DevApps/SidecarAdapter/typescript by @dependabot[bot] in AzureAD/microsoft-identity-web#3753 * Update changelog.md for ID.Web 4.6.0 by @bgavrilMS in AzureAD/microsoft-identity-web#3756 * Add token binding to MicrosoftIdentityMessageHandler by @cpp11nullptr in AzureAD/microsoft-identity-web#3743 * Bump picomatch in /tests/DevApps/SidecarAdapter/typescript by @dependabot[bot] in AzureAD/microsoft-identity-web#3759 * Documentation: Clarify managed identity credential types for containerized vs. VM/App Service deployments by @Copilot in AzureAD/microsoft-identity-web#3585 * Bump path-to-regexp from 8.3.0 to 8.4.0 in /tests/DevApps/SidecarAdapter/typescript by @dependabot[bot] in AzureAD/microsoft-identity-web#3762 * Upgrade Microsoft Application Insights packages by @RojaEnnam in AzureAD/microsoft-identity-web#3763 * Use Abstractions 12 by @pmaytak in AzureAD/microsoft-identity-web#3761 * Post-4.7.0 by @pmaytak in AzureAD/microsoft-identity-web#3768 * Fix Comp Gov DOTNET-Security-10.0 by @reginayap8 in AzureAD/microsoft-identity-web#3769 * Upgrade CodeQL to V4: Fix 10 CodeQL Analysis Warnings and Errors by @reginayap8 in AzureAD/microsoft-identity-web#3770 * fix warnings by @gladjohn in AzureAD/microsoft-identity-web#3771 * adding examples for using postgres as a distributed cache by @JaredMSFT in AzureAD/microsoft-identity-web#3766 * Suppress AOT configuration-binding SYSLIB warnings in AotCompatibility test app by @Copilot in AzureAD/microsoft-identity-web#3774 * Bump vite from 7.1.11 to 7.3.2 in /tests/DevApps/SidecarAdapter/typescript by @dependabot[bot] in AzureAD/microsoft-identity-web#3772 * Skip legacy B2C local-account Todo UI test in WebAppUiTests by @Copilot in AzureAD/microsoft-identity-web#3778 * Fix initialization of ConfidentialClientApplicationOptions in MergedOptions by @cpp11nullptr in AzureAD/microsoft-identity-web#3760 * Bump net8/net9/net10 runtime package baselines to patched crypto servicing versions by @Copilot in AzureAD/microsoft-identity-web#3779 * Fix flaky certificate test failures on CI by @gladjohn in AzureAD/microsoft-identity-web#3780 * MTLS Without Tokens Support by @tlupes in AzureAD/microsoft-identity-web#3747 * Fix CredentialsProvider DI lifetime mismatch causing startup crash in Development by @Avery-Dunn in AzureAD/microsoft-identity-web#3783 * Remove unused DataProtection configuration from Sidecar by @Copilot in AzureAD/microsoft-identity-web#3776 ## New Contributors * @RojaEnnam made their first contribution in AzureAD/microsoft-identity-web#3763 * @reginayap8 made their first contribution in AzureAD/microsoft-identity-web#3769 * @JaredMSFT made their first contribution in AzureAD/microsoft-identity-web#3766 **Full Changelog**: AzureAD/microsoft-identity-web@4.6.0...4.8.0 Commits viewable in [compare view](AzureAD/microsoft-identity-web@4.7.0...4.10.0). </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=Microsoft.Identity.Web&package-manager=nuget&previous-version=4.7.0&new-version=4.10.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: James Gunn <james@gunn.io>

Add token binding to MicrosoftIdentityMessageHandler

8be50c8

cpp11nullptr requested a review from a team as a code owner March 4, 2026 17:20

Merge branch 'master' into iepoly/extend-microsoft-identity-message-h…

b0c1184

…andler-with-token-binding

bgavrilMS reviewed Mar 5, 2026

View reviewed changes

Comment thread src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityMessageHandler.cs Outdated

bgavrilMS reviewed Mar 5, 2026

View reviewed changes

Comment thread src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityMessageHandler.cs Outdated

bgavrilMS reviewed Mar 5, 2026

View reviewed changes

Comment thread src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityMessageHandler.cs

bgavrilMS approved these changes Mar 5, 2026

View reviewed changes

jmprieur reviewed Mar 5, 2026

View reviewed changes

Comment thread docs/calling-downstream-apis/custom-apis.md Outdated

jmprieur requested changes Mar 5, 2026

View reviewed changes

tlupes reviewed Mar 5, 2026

View reviewed changes

Comment thread src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityMessageHandler.cs

Zhenya Polyvanyi added 3 commits March 23, 2026 15:44

Commit changes after code review comments

7d2a3cd

Merge branch 'iepoly/extend-microsoft-identity-message-handler-with-t…

0a072f6

…oken-binding' of https://github.com/AzureAD/microsoft-identity-web into iepoly/extend-microsoft-identity-message-handler-with-token-binding

Merge remote-tracking branch 'origin/master' into iepoly/extend-micro…

6185747

…soft-identity-message-handler-with-token-binding

cpp11nullptr requested a review from a team as a code owner March 23, 2026 15:45

bgavrilMS requested review from gladjohn and jmprieur March 25, 2026 15:23

jmprieur approved these changes Mar 25, 2026

View reviewed changes

Comment thread src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityMessageHandler.cs

Comment thread src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityMessageHandler.cs

Comment thread tests/DevApps/MtlsPop/MtlsPopClient/Program.cs

Refactor CreateDownstreamApiOptions helper method

5ee9150

jmprieur approved these changes Mar 25, 2026

View reviewed changes

Comment thread src/Microsoft.Identity.Web.TokenAcquisition/MicrosoftIdentityMessageHandler.cs

cpp11nullptr merged commit 231b092 into master Mar 25, 2026
4 checks passed

cpp11nullptr deleted the iepoly/extend-microsoft-identity-message-handler-with-token-binding branch March 25, 2026 22:22

bgavrilMS reviewed Mar 26, 2026

View reviewed changes

Avery-Dunn mentioned this pull request Apr 20, 2026

Post-4.8.0 release updates #3784

Merged

Conversation

cpp11nullptr commented Mar 4, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jmprieur left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bgavrilMS commented Mar 5, 2026

Uh oh!

Uh oh!

tlupes commented Mar 5, 2026

Uh oh!

cpp11nullptr commented Mar 23, 2026

Uh oh!

jmprieur left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jmprieur left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

bgavrilMS Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants