Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Refactor game authentication code to use ASP.NET JWT Authentication (#…
…1135) Previously, the authentication code manually read the ID token and BaaS JWKs and determined its validity using `JsonWebTokenHandler`. It then threw an exception if the token was invalid, and relied on `ExceptionHandlerMiddleware` to return the appropriate status code for the game. When I implemented JWT authentication for the website, I used the in-box ASP.NET `AddJwtBearer` authentication and it greatly simplified matters. I have been meaning to do the same for the game authentication code for a while. I got the final push I needed after #1129 which changed it so that every expired token error was logged as an unhandled exception. This clutters the logs and introduces misleading metrics in Grafana: ![image](https://github.com/user-attachments/assets/6045c18c-3fa0-401a-97a7-e7d5da3e508c) As part of simplifying the authentication code, I have also removed the legacy authentication flow, which the server used in its first weeks being live before BaaS was established. This means we now have a hard dependency on BaaS, but it is now open source and available for anyone to host. This old authentication flow had not been tested in literal years, so there's a good chance it wasn't functional anyway.
- Loading branch information