Skip to content

Replace default token provider with single-active variant#25525

Merged
EngincanV merged 2 commits into
devfrom
maliming/default-token-provider-single-active
Jun 2, 2026
Merged

Replace default token provider with single-active variant#25525
EngincanV merged 2 commits into
devfrom
maliming/default-token-provider-single-active

Conversation

@maliming
Copy link
Copy Markdown
Member

@maliming maliming commented Jun 2, 2026

Replaces ASP.NET Core's DataProtectorTokenProvider<IdentityUser> registered under TokenOptions.DefaultProvider with AbpDefaultTokenProvider (extends AbpSingleActiveTokenProvider, 10-minute lifespan). Challenge tokens from the password flows (RequiresTwoFactor, ShouldChangePasswordOnNextLogin, PeriodicallyChangePassword) become single-active per (user, purpose).

Introduce AbpDefaultTokenProvider (10-min lifespan) replacing
DataProtectorTokenProvider under TokenOptions.DefaultProvider, so
challenge tokens (RequiresTwoFactor, ShouldChangePassword) become
single-active.

Document the token provider lineup and fix two factual errors in
the 2FA doc.
Copilot AI review requested due to automatic review settings June 2, 2026 03:13
@maliming maliming added this to the 10.5-preview milestone Jun 2, 2026
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR changes ABP Identity’s ASP.NET Core integration to replace the default ASP.NET Core Identity "Default" token provider with an ABP single-active implementation, making password-flow “challenge” tokens single-active per (user, purpose) with a short default lifespan.

Changes:

  • Register AbpDefaultTokenProvider under TokenOptions.DefaultProvider and introduce AbpDefaultTokenProviderOptions (10-minute default lifespan).
  • Add an ASP.NET Core test suite to validate the default-provider override and purpose isolation behavior.
  • Add/update Identity documentation explaining token-provider replacements and 2FA token behavior.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 6 comments.

Show a summary per file
File Description
modules/identity/src/Volo.Abp.Identity.AspNetCore/Volo/Abp/Identity/AspNetCore/AbpIdentityAspNetCoreModule.cs Overrides the "Default" token provider registration to use AbpDefaultTokenProvider.
modules/identity/src/Volo.Abp.Identity.AspNetCore/Volo/Abp/Identity/AspNetCore/AbpDefaultTokenProviderOptions.cs Adds options type setting provider name and 10-minute token lifespan.
modules/identity/src/Volo.Abp.Identity.AspNetCore/Volo/Abp/Identity/AspNetCore/AbpDefaultTokenProvider.cs Implements the default provider as a single-active token provider.
modules/identity/test/Volo.Abp.Identity.AspNetCore.Tests/Volo/Abp/Identity/AspNetCore/AbpDefaultTokenProvider_Tests.cs Adds tests verifying override behavior, defaults, and per-purpose isolation.
docs/en/modules/identity/two-factor-authentication.md Updates 2FA documentation details (notably authenticator provider behavior and storage format).
docs/en/modules/identity/token-providers.md Adds new documentation page describing ABP token providers and configuration/invalidation guidance.
docs/en/modules/identity-pro.md Links the new “Identity Token Providers” documentation page from the module doc index.

Comment thread docs/en/modules/identity/token-providers.md Outdated
Comment thread docs/en/modules/identity/token-providers.md
Comment thread docs/en/modules/identity/token-providers.md Outdated
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

@maliming maliming requested a review from EngincanV June 2, 2026 03:42
@codecov
Copy link
Copy Markdown

codecov Bot commented Jun 2, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.44%. Comparing base (002e9b4) to head (20acbd1).
⚠️ Report is 12 commits behind head on dev.

Additional details and impacted files
@@            Coverage Diff             @@
##              dev   #25525      +/-   ##
==========================================
- Coverage   49.45%   49.44%   -0.02%     
==========================================
  Files        3671     3673       +2     
  Lines      123912   123921       +9     
  Branches     9474     9474              
==========================================
- Hits        61278    61270       -8     
- Misses      60811    60829      +18     
+ Partials     1823     1822       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@EngincanV EngincanV merged commit 6bc06af into dev Jun 2, 2026
5 of 6 checks passed
@EngincanV EngincanV deleted the maliming/default-token-provider-single-active branch June 2, 2026 06:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants