Class SessionContextMiddleware

Namespace

Stratara.Sessions.Middlewares

Assembly

Stratara.Sessions.dll

ASP.NET Core middleware that populates the ambient ISessionContextProvider from the incoming request's JWT claims. For unauthenticated requests the middleware leaves the provider untouched.

public sealed class SessionContextMiddleware

Inheritance

object

SessionContextMiddleware

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Extension Methods

FieldChangedEventExtensions.ApplyPropertyChanged<TAggregate>(TAggregate, FieldChangedEvent<TAggregate>)

EventStream.ApplyEvents(object, IReadOnlyList<IEvent>)

Remarks

Default behaviour is Actor = Subject — UserPlatform users operate on their own tenant's data. PlatformAdmin endpoints that act on a foreign tenant override TenantId after authorization.

The X-Tenant-Id HTTP header is honoured as a fallback for the tenant claim only when AllowTenantHeader is set to true. The default since 3.0.10 is fail-closed: a missing or unparsable claim resolves to Value regardless of the header. See Round-3-Audit Finding KI-04 for the threat model.

Constructors

SessionContextMiddleware(RequestDelegate, IOptions<SessionContextOptions>)

ASP.NET Core middleware that populates the ambient ISessionContextProvider from the incoming request's JWT claims. For unauthenticated requests the middleware leaves the provider untouched.

public SessionContextMiddleware(RequestDelegate next, IOptions<SessionContextOptions> options)

Parameters

next RequestDelegate

options IOptions<SessionContextOptions>

Remarks

Default behaviour is Actor = Subject — UserPlatform users operate on their own tenant's data. PlatformAdmin endpoints that act on a foreign tenant override TenantId after authorization.

The X-Tenant-Id HTTP header is honoured as a fallback for the tenant claim only when AllowTenantHeader is set to true. The default since 3.0.10 is fail-closed: a missing or unparsable claim resolves to Value regardless of the header. See Round-3-Audit Finding KI-04 for the threat model.

Methods

InvokeAsync(HttpContext, ISessionContextProvider)

Process a single request: parse identity claims and set the session context.

public Task InvokeAsync(HttpContext httpContext, ISessionContextProvider sessionContextProvider)

Parameters

httpContext HttpContext

The current request's HttpContext.

sessionContextProvider ISessionContextProvider

The ambient session-context provider (DI-resolved per request).

Returns

Task