Harden RefreshSignInCoreAsync to revalidate cookie always

[cincuranet]

Basically call ValidateSecurityStampAsync after the same-user check, before re-issuing.

[github-actions]

Triage Summary

Area: area-identity (request targets RefreshSignInCoreAsync and ValidateSecurityStampAsync in SignInManager<TUser>)
Type: Feature (proposes a new behavior — calling ValidateSecurityStampAsync inside RefreshSignInCoreAsync before re-issuing the cookie)

Potential Duplicates

• None found

Notes

• Relevant code: src/Identity/Core/src/SignInManager.cs, method RefreshSignInCoreAsync and ValidateSecurityStampAsync.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Triage Comment Reviewer for dotnet/aspnetcore for #68084 · 16.9 AIC · ⌖ 6.34 AIC · ⊞ 8.2K · ◷