ITicketStore from DI

[leastprivilege]

Wouldn't it make sense to resolve the ITicketStore for the cookie handler from DI in the future?

[kevinchalet]

FYI, it's been discussed here: aspnet/Security#1719.

[leastprivilege]

I am glad you have the time to search the archives ;)

[brockallen]

It would nice to add this.

[Eilon]

Marking as up-for-grabs in case someone wants to take a crack at this. We don't currently plan to implement this ourselves, but we'd be open to a collaboration/contribution for this.

[crozone]

We're currently implementing a DbContext based implementation of ITicketStore, and this requires ITicketStore to be accessible via DI in a Scoped context.

The solution should be very similar to the implementation for services.AddDataProtection().PersistKeysToDbContext<ApplicationDbContext>();, however the AddCookie() extension provides no access to the DI container.

The current solution is to use services.AddOptions<CookieAuthenticationOptions>(CookieAuthenticationDefaults.AuthenticationScheme).Configure<ITicketStore>((o, t) => o.SessionStore = t);, but we cannot make guarantees about DbContext lifetime. If we discover a cleaner way to do this, I'll look into submitting a PR.

EDIT: Our workaround for the DbContext lifetime issue is to have IServiceProvider injected into our implementation of ITicketStore, and it creates and manages the necessary scopes internally to safely use DbContext. In this way, the lifetime of ITicketStore becomes a non-issue. It's not pretty, but it works for now. We'll continue to look into creating a more elegant solution.

[niklasholm]

Also, it would be neat to have some default implementation(s) for ITicketStore available, for example one using ISession to store the data.

[Tratcher]

FYI this is much improved by #19268.
.AddCookie<MemoryCacheTicketStore>((o, ticketStore) => o.SessionStore = ticketStore);

[kevinchalet]

@Tratcher it only works with singleton services, right?

[Tratcher]

Correct, but a singleton can inject the IServiceProvider and create its own scope.

[kevinchalet]

Interesting. Why not adding a SessionStoreType property like what we did for EventsType? It works amazingly well.

[Tratcher]

We can, but it's never become a priority. The new extensions are a general feature for a general problem.