SignInManager: return SignInResult.Failed for expired passkey session challenge by GrantTotinov · Pull Request #67539 · dotnet/aspnetcore

GrantTotinov · 2026-07-01T16:50:24Z

SignInManager: return SignInResult.Failed for expired passkey session challenge

You've read the Contributor Guide and Code of Conduct.
You've included unit or integration tests for your change, where applicable.
You've included inline docs for your change, where applicable.
There's an open issue for the PR that you are making.

Summary of the changes

Return SignInResult.Failed for expired or missing passkey session challenge.

Description

Passkey sign-in currently throws when the server-side session challenge is missing or expired, resulting in an unhandled exception instead of a controlled sign-in failure.

This change ensures that missing or invalid passkey session state results in SignInResult.Failed, aligning the behavior with other SignInManager authentication flows.

Changes

Handle missing or expired passkey session state in PasskeySignInCoreAsync
Prevent InvalidOperationException for recoverable authentication failures
Add unit test covering expired/missing session scenario

Testing

Added PasskeySignInReturnsFailedWhenSessionChallengeHasExpired
Verified existing passkey tests pass locally

Fixes #67410

…ion challenge

Copilot

Pull request overview

Updates ASP.NET Core Identity’s SignInManager passkey sign-in flow so an expired/missing passkey session challenge results in a controlled SignInResult.Failed outcome instead of an unhandled exception, and adds a unit test for the scenario.

Changes:

Add an early check in PasskeySignInCoreAsync to return SignInResult.Failed when passkey session state is missing/invalid.
Add a new unit test covering the “expired/missing session challenge” passkey sign-in scenario.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
src/Identity/Core/src/SignInManager.cs	Adds early failure handling for missing/invalid passkey session state during passkey sign-in.
src/Identity/test/Identity.Test/SignInManagerTest.cs	Adds a new test to validate passkey sign-in returns `Failed` when the passkey session challenge is expired/missing.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

…alled

GrantTotinov · 2026-07-29T21:36:19Z

@javiercn Sorry to tag you directly. I wasn't sure who to ping since there's no CODEOWNERS entry for this path. Could you take a look when you get a chance? Most checks are green (the two failing ones look unrelated - Windows local dev validation and an aggregate summary). Thanks!

halter73

Thanks for the PR!

Co-authored-by: Stephen Halter <shalter+msft@microsoft.com>

halter73 · 2026-08-20T00:01:41Z

/backport to release/11.0-rc1

github-actions · 2026-08-20T00:01:50Z

Started backporting to release/11.0-rc1 (link to workflow run)

… challenge (#67539) (#68654) Co-authored-by: Grant Totinov <granttotinov604@gmail.com>

* [SignalR] Reject duplicate SignalR upload stream IDs (#68525) (#68638) * Reject duplicate SignalR upload stream IDs * Simplify upload stream ownership cleanup * Avoid upload stream ownership allocations * Simplify upload stream registration ownership * Defer upload stream reader creation * Dispose cancellation source after binding failure * Reuse upload stream test helper --------- Co-authored-by: Javier Calvarro Nelson <jacalvar@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 82e97f5a-a052-4dbe-9cf1-b62f45cf7ee2 * Honor all sign-in confirmation requirements after registration (#68631) (#68655) Co-authored-by: Brennan <brecon@microsoft.com> * Preserve BadHttpRequestException status codes (#68632) (#68649) * Preserve BadHttpRequestException status codes * Preserve exception handler 404 safeguard --------- Co-authored-by: Stephen Halter <halter73@gmail.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * SignInManager: return SignInResult.Failed for expired passkey session challenge (#67539) (#68654) Co-authored-by: Grant Totinov <granttotinov604@gmail.com> * Don't apply the CSRF verdict to remote authentication callbacks (#68669) * Don't apply the CSRF verdict to remote authentication callbacks A remote provider's callback (OIDC response_mode=form_post, WS-Federation) is a cross-site form POST by protocol design, so the auto-injected CSRF protection records an invalid IAntiforgeryValidationFeature verdict for it. The handler then throws while reading its own callback body, before any of its events can run, so apps have no way to opt out. Suppress the verdict while a remote handler owns the request, and restore it if the handler declines so the rest of the pipeline still sees it. Fixes #68666 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: cb987098-3301-465b-9a3d-2e63aabf43bd * test both antiforgery & csrf --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: cb987098-3301-465b-9a3d-2e63aabf43bd * Use model display names in Blazor input parsing errors (#68667) (#68688) * Use display attributes in input parsing errors * Address test coverage feedback from review. * Apply dedup cleanup from feedback. Co-authored-by: Ilona Tomkowicz <32700855+ilonatommy@users.noreply.github.com> * [release/11.0-rc1] Extract IsAuthenticated helper method (#68658) * Extract IsAuthenticated helper method Co-authored-by: Youssef1313 <31348972+Youssef1313@users.noreply.github.com> * Reorder using Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Youssef1313 <31348972+Youssef1313@users.noreply.github.com> * Use SecurityHelper for authentication revalidation Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Youssef1313 <31348972+Youssef1313@users.noreply.github.com> --------- Co-authored-by: Youssef1313 <youssefvictor00@gmail.com> Co-authored-by: Youssef1313 <31348972+Youssef1313@users.noreply.github.com> Co-authored-by: Milos Kotlar <kotlarmilos@gmail.com> * Fix InitialItemIndex viewport underfill for small items in big container or on window resize (#67936) (#68689) Co-authored-by: Ilona Tomkowicz <32700855+ilonatommy@users.noreply.github.com> * fix nullable<union> for openapi gen (#68665) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Javier Calvarro Nelson <jacalvar@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Brennan <brecon@microsoft.com> Co-authored-by: Stephen Halter <halter73@gmail.com> Co-authored-by: Grant Totinov <granttotinov604@gmail.com> Co-authored-by: Korolev Dmitry <dmkorolev@microsoft.com> Co-authored-by: Ilona Tomkowicz <32700855+ilonatommy@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Youssef1313 <youssefvictor00@gmail.com> Co-authored-by: Youssef1313 <31348972+Youssef1313@users.noreply.github.com> Co-authored-by: Milos Kotlar <kotlarmilos@gmail.com> Co-authored-by: William Godbe <wigodbe@microsoft.com> Copilot-Session: 82e97f5a-a052-4dbe-9cf1-b62f45cf7ee2 Copilot-Session: cb987098-3301-465b-9a3d-2e63aabf43bd

Fix PasskeySignInAsync to return SignInResult.Failed for expired sess…

eede42a

…ion challenge

Copilot AI review requested due to automatic review settings July 1, 2026 16:50

Copilot started reviewing on behalf of GrantTotinov July 1, 2026 16:50 View session

Copilot AI reviewed Jul 1, 2026

View reviewed changes

Comment thread src/Identity/Core/src/SignInManager.cs

Comment thread src/Identity/test/Identity.Test/SignInManagerTest.cs Outdated

Comment thread src/Identity/test/Identity.Test/SignInManagerTest.cs

GrantTotinov and others added 3 commits July 2, 2026 01:43

Potential fix for pull request finding

6f8843f

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Apply Copilot suggestions: add .Verifiable() and verify handler not c…

ba63855

…alled

Merge branch 'main' into fix-passkey-signin-expired-session

fdec8f0

build-analysis Bot mentioned this pull request Jul 2, 2026

Sometimes the helix SDK uses GetWorkItemsAsync when workitems aren't done processing. dotnet/dnceng#6011

Open

3 tasks

GrantTotinov added 2 commits July 2, 2026 23:32

Merge branch 'main' into fix-passkey-signin-expired-session

ddec2c7

Merge branch 'main' into fix-passkey-signin-expired-session

9d6741c

This was referenced Jul 13, 2026

slow macOS - "##[error]The job running on agent Azure Pipelines 9 ran longer than the maximum time of 60 minutes." dotnet/dnceng#1883

Open

The Operation will be canceled. The next steps may not contain expected logs. dotnet/dnceng#3008

Open

GrantTotinov added 4 commits July 14, 2026 15:31

Merge branch 'main' into fix-passkey-signin-expired-session

ad0d0fd

Merge branch 'main' into fix-passkey-signin-expired-session

245d308

Merge branch 'main' into fix-passkey-signin-expired-session

c683309

Merge branch 'main' into fix-passkey-signin-expired-session

1eb52f4

This was referenced Jul 20, 2026

Unable to read data from the transport connection: An existing connection was forcibly closed by the remote host. dotnet/dnceng#5922

Open

[Known build issue] Interop.FunctionalTest fail #63147

Open

GrantTotinov added 3 commits July 22, 2026 18:14

Merge branch 'main' into fix-passkey-signin-expired-session

a8e1c68

Merge branch 'main' into fix-passkey-signin-expired-session

4ab7a8a

Merge branch 'main' into fix-passkey-signin-expired-session

8ff4eab

javiercn added area-identity Includes: Identity and providers community-contribution Indicates that the PR has been added by a community member labels Jul 30, 2026

javiercn temporarily deployed to copilot-pat-pool July 30, 2026 08:30 — with GitHub Actions Inactive

javiercn temporarily deployed to copilot-pat-pool July 30, 2026 08:31 — with GitHub Actions Inactive

javiercn temporarily deployed to copilot-pat-pool July 30, 2026 08:32 — with GitHub Actions Inactive

javiercn had a problem deploying to copilot-pat-pool July 30, 2026 08:33 — with GitHub Actions Failure

javiercn temporarily deployed to copilot-pat-pool July 30, 2026 08:35 — with GitHub Actions Inactive

javiercn temporarily deployed to copilot-pat-pool July 30, 2026 08:36 — with GitHub Actions Inactive

javiercn temporarily deployed to copilot-pat-pool July 30, 2026 08:37 — with GitHub Actions Inactive

GrantTotinov added 2 commits August 3, 2026 18:41

Merge branch 'main' into fix-passkey-signin-expired-session

4ab05a5

Merge branch 'main' into fix-passkey-signin-expired-session

964997f

halter73 reviewed Aug 19, 2026

View reviewed changes

Comment thread src/Identity/Core/src/SignInManager.cs Outdated

Update src/Identity/Core/src/SignInManager.cs

50375ae

halter73 approved these changes Aug 19, 2026

View reviewed changes

halter73 enabled auto-merge (squash) August 19, 2026 20:08

dotnet deleted a comment from github-actions Bot Aug 19, 2026

halter73 reviewed Aug 19, 2026

View reviewed changes

Comment thread src/Identity/Core/src/SignInManager.cs Outdated

halter73 reviewed Aug 19, 2026

View reviewed changes

Comment thread src/Identity/Core/src/SignInManager.cs

Apply batched suggestions from code review

f6fc452

Co-authored-by: Stephen Halter <shalter+msft@microsoft.com>

BrennanConroy approved these changes Aug 19, 2026

View reviewed changes

halter73 merged commit 953cfb2 into dotnet:main Aug 19, 2026
25 checks passed

github-actions Bot mentioned this pull request Aug 20, 2026

[release/11.0-rc1] SignInManager: return SignInResult.Failed for expired passkey session challenge #68654

Merged

11 tasks

dotnet-maestro Bot mentioned this pull request Aug 20, 2026

[main] Source code updates from dotnet/aspnetcore dotnet/dotnet#8472

Merged

dotnet-milestone-bot Bot added this to the 12.0-preview1 milestone Aug 20, 2026

wtgodbe pushed a commit that referenced this pull request Aug 21, 2026

SignInManager: return SignInResult.Failed for expired passkey session…

555ae4e

… challenge (#67539) (#68654) Co-authored-by: Grant Totinov <granttotinov604@gmail.com>

rolandVi mentioned this pull request Aug 31, 2026

Align passkey guidance with the .NET 11 Blazor template dotnet/AspNetCore.Docs#37559

Open

Navigation Menu

Uh oh!

SignInManager: return SignInResult.Failed for expired passkey session challenge - #67539

SignInManager: return SignInResult.Failed for expired passkey session challenge#67539
halter73 merged 17 commits into
dotnet:mainfrom
GrantTotinov:fix-passkey-signin-expired-session

GrantTotinov commented Jul 1, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

GrantTotinov commented Jul 29, 2026

Uh oh!

halter73 left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

halter73 commented Aug 20, 2026

Uh oh!

github-actions Bot commented Aug 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

GrantTotinov commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

SignInManager: return SignInResult.Failed for expired passkey session challenge

Summary of the changes

Description

Changes

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

GrantTotinov commented Jul 29, 2026

Uh oh!

halter73 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

halter73 commented Aug 20, 2026

Uh oh!

github-actions Bot commented Aug 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

GrantTotinov commented Jul 1, 2026 •

edited

Loading