JsonWebTokenHandler.ReplaceTokenHeader(JsonWebToken, String) Method
Definition
Important
Some information relates to prerelease product that may be substantially modified before it’s released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
Creates a new JsonWebToken by replacing the header of an existing JsonWebToken, reusing its already parsed payload and signature.
public virtual Microsoft.IdentityModel.JsonWebTokens.JsonWebToken ReplaceTokenHeader(Microsoft.IdentityModel.JsonWebTokens.JsonWebToken jsonWebToken, string encodedHeader);abstract member ReplaceTokenHeader : Microsoft.IdentityModel.JsonWebTokens.JsonWebToken * string -> Microsoft.IdentityModel.JsonWebTokens.JsonWebToken
override this.ReplaceTokenHeader : Microsoft.IdentityModel.JsonWebTokens.JsonWebToken * string -> Microsoft.IdentityModel.JsonWebTokens.JsonWebTokenPublic Overridable Function ReplaceTokenHeader (jsonWebToken As JsonWebToken, encodedHeader As String) As JsonWebTokenParameters
- jsonWebToken
- JsonWebToken
The signed JsonWebToken (JWS) whose payload and signature are reused.
- encodedHeader
- String
The Base64UrlEncoded header that replaces the header of jsonWebToken.
Returns
A JsonWebToken formed as 'encodedHeader.EncodedPayload.EncodedSignature'.
Exceptions
Thrown if encodedHeader is null or empty.
Thrown if jsonWebToken is an encrypted token (JWE), as its payload cannot be reused.
Remarks
This is an intentional transform for header-only rewrites (for example, hashing a Protected Forwarded Token nonce). Only the replacement header is decoded and parsed; the payload is reused from jsonWebToken without re-parsing.
The signature of jsonWebToken is reused verbatim and is NOT recomputed. The resulting token therefore only validates when encodedHeader reconstructs the header over which the original signature was computed; supplying an arbitrary header produces a token whose signature will fail validation.
The returned token is NOT validated. Use ValidateToken(String, TokenValidationParameters) or ValidateTokenAsync(String, TokenValidationParameters) to ensure the token is acceptable.