Introduce a force_verify option in the Twitch provider

Author: zAfLu

src/AspNet.Security.OAuth.Twitch/TwitchAuthenticationHandler.cs

@@ -4,6 +4,7 @@
  * for more information concerning the license and the contributors participating to this project.
  */
 
+using System.Collections.Generic;
 using System.Net.Http;
 using System.Net.Http.Headers;
 using System.Security.Claims;
@@ -13,6 +14,7 @@
 using Microsoft.AspNetCore.Authentication;
 using Microsoft.AspNetCore.Authentication.OAuth;
 using Microsoft.AspNetCore.Http.Authentication;
+using Microsoft.AspNetCore.WebUtilities;
 using Microsoft.Extensions.Logging;
 using Newtonsoft.Json.Linq;
 using static AspNet.Security.OAuth.Twitch.TwitchAuthenticationConstants;
@@ -26,6 +28,17 @@ public TwitchAuthenticationHandler([NotNull] HttpClient client)
         {
         }
 
+        protected override string BuildChallengeUrl(AuthenticationProperties properties, string redirectUri)
+            => QueryHelpers.AddQueryString(Options.AuthorizationEndpoint, new Dictionary<string, string>
+            {
+                ["client_id"] = Options.ClientId,
+                ["scope"] = FormatScope(),
+                ["response_type"] = "code",
+                ["redirect_uri"] = redirectUri,
+                ["state"] = Options.StateDataFormat.Protect(properties),
+                ["force_verify"] = Options.ForceVerify ? "true" : "false"
+            });
+
         protected override async Task<AuthenticationTicket> CreateTicketAsync([NotNull] ClaimsIdentity identity,
             [NotNull] AuthenticationProperties properties, [NotNull] OAuthTokenResponse tokens)
         {

src/AspNet.Security.OAuth.Twitch/TwitchAuthenticationOptions.cs

@@ -28,5 +28,12 @@ public TwitchAuthenticationOptions()
 
             Scope.Add("user:read:email");
         }
+
+        /// <summary>
+        /// Gets or sets a boolean indicating whether the "force_verify=true" flag should be sent to Twitch.
+        /// When set to <c>true</c>, Twitch displays the consent screen for every authorization request.
+        /// When left to <c>false</c>, the consent screen is skipped if the user is already logged in.
+        /// </summary>
+        public bool ForceVerify { get; set; }
     }
 }