{"action":"closed","issue":{"url":"https://api.github.com/repos/aspnet/Security/issues/847","repository_url":"https://api.github.com/repos/aspnet/Security","labels_url":"https://api.github.com/repos/aspnet/Security/issues/847/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/847/comments","events_url":"https://api.github.com/repos/aspnet/Security/issues/847/events","html_url":"https://github.com/aspnet/Security/issues/847","id":157050721,"number":847,"title":"Please provide a way to re-authenticate in the same request (clear AuthenticationHandler<TOptions>._authenticateTask)","user":{"login":"rwasef1830","id":4632253,"avatar_url":"https://avatars.githubusercontent.com/u/4632253?v=3","gravatar_id":"","url":"https://api.github.com/users/rwasef1830","html_url":"https://github.com/rwasef1830","followers_url":"https://api.github.com/users/rwasef1830/followers","following_url":"https://api.github.com/users/rwasef1830/following{/other_user}","gists_url":"https://api.github.com/users/rwasef1830/gists{/gist_id}","starred_url":"https://api.github.com/users/rwasef1830/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rwasef1830/subscriptions","organizations_url":"https://api.github.com/users/rwasef1830/orgs","repos_url":"https://api.github.com/users/rwasef1830/repos","events_url":"https://api.github.com/users/rwasef1830/events{/privacy}","received_events_url":"https://api.github.com/users/rwasef1830/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-05-26T18:40:48Z","updated_at":"2016-05-26T19:44:23Z","closed_at":"2016-05-26T19:44:23Z","body":"Hello aspnet team,\r\nSometimes I store sensitive information in the user claims which needs to be recomputed when a user changes their password. This means that I need to call ```Context.Authentication.AuthenticateAsync``` to reissue the cookie (for example. in the case of CookieAuthenticationHandler) to do it transparently during the POST of the password change action.\r\n\r\nHowever, because ```AuthenticationHandler<TOptions>.HandleAuthenticateOnceAsync()``` does a short-circuit check to check if a task is already present in ```_authenticateTask``` and simply returns, I cannot reissue the cookie. There is simply no code path that set ```_authenticateTask``` to null.\r\n\r\nI'm forced to either: \r\n- Log the user out and ask them to re-login (to clear the cookie).\r\n- Store this info outside claims somewhere else and have to duplicate encryption/security logic which is already nice and good in CookieAuthenticationHandler.\r\n\r\nIs there any workaround I can use to force reissuance of the authentication ticket/cookie ? It is not easy to try to inherit from the authentication middleware because the offending logic is in the base AuthenticationHandler class and I'd have to duplicate the whole thing to implement it and reimplement all auth middleware to use my new base class.\r\n"}}
{"actor":{"display_login":"rwasef1830"}}