Class SessionContextOptions

Namespace

Stratara.Abstractions.Session

Assembly

Stratara.Abstractions.dll

Configuration for Stratara's SessionContextMiddleware — controls how the ambient ISessionContextProvider resolves identity from inbound requests.

[ExcludeFromCodeCoverage]
public sealed class SessionContextOptions

Inheritance

object

SessionContextOptions

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Extension Methods

FieldChangedEventExtensions.ApplyPropertyChanged<TAggregate>(TAggregate, FieldChangedEvent<TAggregate>)

EventStream.ApplyEvents(object, IReadOnlyList<IEvent>)

Remarks

Bind from configuration via section SectionName ("SessionContext") or programmatically via services.Configure<SessionContextOptions>(o => ...).

Fields

SectionName

Configuration section name ("SessionContext") used to bind these options.

public const string SectionName = "SessionContext"

Field Value

string

Properties

AllowTenantHeader

Allows the X-Tenant-Id HTTP header to substitute for a missing stratara:tenant_id JWT claim when resolving the subject tenant. Defaults to false since 3.0.10 — opt-in required.

public bool AllowTenantHeader { get; set; }

Property Value

bool

Remarks

Why the default is fail-closed: in earlier versions the middleware silently fell back to the header whenever the claim was missing or unparsable, which allowed any authenticated principal to choose the tenant their request operated against (cross-tenant read in hosts whose identity provider does not embed a tenant claim in the JWT). Round-3-Audit Finding KI-04.

When to opt in (true): when the consumer guarantees the header is gated upstream by a platform-admin role check, or when service-to-service calls carry the header as part of an internal trusted contract. The preferred alternative is to embed the tenant id directly into the JWT claim set so no header fallback is needed.