[Bug] WebApiAuthenticationBuilderExtensions.cs should consider cloning TokenValidationParameters

[brentschmaltz]

Which Version of Microsoft Identity Web are you using ?
Note that to get help, you need to run the latest version.
Microsoft Identity Web 0.1.5-preview

Where is the issue?
AddMicrosoftWebApi uses the value of TokenValidationParameters from JwtBearerOptions. Any modifications will affect any other users of JwtBearerOptions. It would be better to use TokenValidationParameters.Clone().

[jmprieur]

Thanks @brentschmaltz !

[jmprieur]

@brentschmaltz is it only about adding

options.TokenValidationParameters = options.TokenValidationParameters.Clone();

before starting using the options.TokenValidationParameters ? for instance here: https://github.com/AzureAD/microsoft-identity-web/blob/master/src/Microsoft.Identity.Web/WebApiAuthenticationBuilderExtensions.cs#L102 ?

cc: @jennyf19 @pmaytak

[brentschmaltz]

@jmprieur i haven't reviewed the entire call graph, but the idea is if you modify TokenValidationParameters by adding an audience, issuer, etc, then you should call clone first.
When we developed JwtBearer, we created a local copy before any modifications. To get an idea see: https://github.com/dotnet/aspnetcore/blob/4a93863b8d865bb4d65f77b34ee335d7b23a79fc/src/Security/Authentication/JwtBearer/src/JwtBearerHandler.cs#L91 . This issue is to make sure we follow the same pattern. Let me know if you want me to review anything.

[jmprieur]

Thanks @brentschmaltz
@pmaytak I see you self-assigned the issue. please add Brent to the PR review.

[jennyf19]

Included in 0.2.0-preview release