Skip to content

Misleading IsLoggedIn implementation in OpenIDConnectService #35

@AKissMail

Description

@AKissMail

In the OpenIDConnectService class, the IsLoggedIn property is implemented as:

public bool IsLoggedIn { get => !string.IsNullOrEmpty(AccessToken); }

However, this implementation is misleading:

  1. The name and XML summary imply reliable login state detection, but the logic only checks whether the AccessToken is non-empty.
  2. There is no validation of the token's validity, expiry, or whether it has been revoked.
  3. This could lead to incorrect assumptions elsewhere in the application, where IsLoggedIn == true is interpreted as "user is currently authenticated".

Suggestion: Either rename the property to something more neutral (e.g. HasAccessToken) or implement a token validation there.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions