Class MustChangePasswordMiddleware

Namespace

KadicAuth.Api.Middleware

Assembly

KadicAuth.Api.dll

Hard gate for temporary passwords (plan portal-user-provisioning P4). While the JWT carries the "must_change_password" claim, KadicAuth rejects every authenticated request with 403 EXCEPT the two the user legitimately needs to escape the state: change-password and logout. The frontend redirect is UX only — this is the security control that stops a temporary password from being used as a full session via direct API calls.

public sealed class MustChangePasswordMiddleware

Inheritance

object

MustChangePasswordMiddleware

Constructors

MustChangePasswordMiddleware(RequestDelegate)

public MustChangePasswordMiddleware(RequestDelegate next)

Parameters

next RequestDelegate

Methods

Invoke(HttpContext)

public Task Invoke(HttpContext context)

Parameters

context HttpContext

Returns

Task