Do not add claims twice for cookie auth
What the developer wrote
Authored by Nicolas Dorier
Do not add claims twice for cookie auth
What changed, and why it matters
This commit fixes a small bug where a special permission claim was being added to a user's identity every time it was transformed, instead of only once. Repeated claims are harmless in most cases, but could in theory cause the identity to grow unexpectedly or lead to subtle authorization behavior. The fix checks whether the permission claim already exists before adding it again.
Review whether any authorization logic relies on claim uniqueness or count, and verify that duplicate claims cannot influence access decisions. The patch should be applied; no immediate incident response is indicated.
Security signals we found
Duplicate claim injection on repeated claims transformation
Authorization claim manipulation in authentication pipeline
Potential identity bloat or unexpected claim enumeration behavior
Evidence from the diff
In CookieAuthenticationClaimTransformer.TransformAsync, the code unconditionally added a Permission claim (Policies.Unrestricted) whenever the principal had a cookie authentication identity. The patch adds a guard using claimsIdentity.HasClaim(…) to ensure the claim is only added if it is not already present. This prevents duplicate claims on repeated transformations of the same principal.
Changed components
BTCPayServer/Security/CookieAuthenticationClaimTransformer.csInspect captured patch +2 / −1
diff --git a/BTCPayServer/Security/CookieAuthenticationClaimTransformer.cs b/BTCPayServer/Security/CookieAuthenticationClaimTransformer.cs
index d171e28..adee995 100644
--- a/BTCPayServer/Security/CookieAuthenticationClaimTransformer.cs
+++ b/BTCPayServer/Security/CookieAuthenticationClaimTransformer.cs
@@ -11,7 +11,8 @@ public class CookieAuthenticationClaimTransformer : IClaimsTransformation
{
public Task<ClaimsPrincipal> TransformAsync(ClaimsPrincipal principal)
{
- if (principal.Identity is { AuthenticationType : AuthenticationSchemes.Cookie } and ClaimsIdentity claimsIdentity)
+ if (principal.Identity is { AuthenticationType : AuthenticationSchemes.Cookie } and ClaimsIdentity claimsIdentity
+ && !claimsIdentity.HasClaim(c => c.Type == GreenfieldConstants.ClaimTypes.Permission))
{
claimsIdentity.AddClaim(new Claim(GreenfieldConstants.ClaimTypes.Permission,
Permission.Create(Policies.Unrestricted).ToString()));
Why this scored 26/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.