Adjusted the maximum token size dynamically based on the token length to prevent 403 Forbidden errors when handling large tokens. (#971)

claudiamurialdo · claudiamurialdo · commit 4d7a01c93934 · 2025-06-03T11:17:36.000-03:00
(cherry picked from commit 07e1dae)
diff --git a/dotnet/src/dotnetframework/GxClasses/Security/WebSecurity.cs b/dotnet/src/dotnetframework/GxClasses/Security/WebSecurity.cs
@@ -128,6 +128,10 @@ internal static WebSecureToken getWebSecureToken(string signedToken, string secr
 			using (var hmac = new System.Security.Cryptography.HMACSHA256(bSecretKey))
 			{
 				var handler = new JwtSecurityTokenHandler();
+				if (signedToken.Length >= handler.MaximumTokenSizeInBytes)
+				{
+					handler.MaximumTokenSizeInBytes = signedToken.Length + 1;
+				}
 				var validationParameters = new TokenValidationParameters
 				{
 					ClockSkew = TimeSpan.FromMinutes(1),

Original file line number	Diff line number	Diff line change
`@@ -128,6 +128,10 @@ internal static WebSecureToken getWebSecureToken(string signedToken, string secr`
`128`	`128`	`using (var hmac = new System.Security.Cryptography.HMACSHA256(bSecretKey))`
`129`	`129`	`{`
`130`	`130`	`var handler = new JwtSecurityTokenHandler();`
	`131`	`+ if (signedToken.Length >= handler.MaximumTokenSizeInBytes)`
	`132`	`+ {`
	`133`	`+ handler.MaximumTokenSizeInBytes = signedToken.Length + 1;`
	`134`	`+ }`
`131`	`135`	`var validationParameters = new TokenValidationParameters`
`132`	`136`	`{`
`133`	`137`	`ClockSkew = TimeSpan.FromMinutes(1),`