SymmetricSecurityKey needs 32 bytes

- This could also be worked around with an AppContext switch: "Switch.Microsoft.IdentityModel.UnsafeRelaxHmacKeySizeValidation"
- See https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/wiki/IDX10720 for more info

Author: halter73

src/SignalR/common/Http.Connections/test/HttpConnectionDispatcherTests.cs

@@ -13,6 +13,7 @@
 using System.Net.Http;
 using System.Net.WebSockets;
 using System.Security.Claims;
+using System.Security.Cryptography;
 using System.Security.Principal;
 using System.Text;
 using System.Threading;
@@ -2762,7 +2763,7 @@ public async Task ConnectionClosedRequestedTriggeredOnAuthExpiration()
         [InlineData(HttpTransportType.WebSockets)]
         public async Task AuthenticationExpirationSetOnAuthenticatedConnectionWithJWT(HttpTransportType transportType)
         {
-            SymmetricSecurityKey SecurityKey = new SymmetricSecurityKey(Guid.NewGuid().ToByteArray());
+            SymmetricSecurityKey SecurityKey = new SymmetricSecurityKey(SHA256.HashData(Guid.NewGuid().ToByteArray()));
             JwtSecurityTokenHandler JwtTokenHandler = new JwtSecurityTokenHandler();
 
             using var host = CreateHost(services =>
@@ -2924,7 +2925,7 @@ public async Task AuthenticationExpirationSetOnAuthenticatedConnectionWithCookie
         [InlineData(HttpTransportType.WebSockets)]
         public async Task AuthenticationExpirationUsesCorrectScheme(HttpTransportType transportType)
         {
-            var SecurityKey = new SymmetricSecurityKey(Guid.NewGuid().ToByteArray());
+            var SecurityKey = new SymmetricSecurityKey(SHA256.HashData(Guid.NewGuid().ToByteArray()));
             var JwtTokenHandler = new JwtSecurityTokenHandler();
 
             using var host = CreateHost(services =>

src/SignalR/samples/JwtSample/Startup.cs

@@ -18,7 +18,7 @@ namespace JwtSample
 {
     public class Startup
     {
-        private readonly SymmetricSecurityKey SecurityKey = new SymmetricSecurityKey(RandomNumberGenerator.GetBytes(16));
+        private readonly SymmetricSecurityKey SecurityKey = new SymmetricSecurityKey(RandomNumberGenerator.GetBytes(32));
         private readonly JwtSecurityTokenHandler JwtTokenHandler = new JwtSecurityTokenHandler();
 
         public void ConfigureServices(IServiceCollection services)

src/SignalR/server/SignalR/test/Startup.cs

@@ -5,6 +5,7 @@
 using System.IdentityModel.Tokens.Jwt;
 using System.IO;
 using System.Security.Claims;
+using System.Security.Cryptography;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.AspNetCore.Authorization;
@@ -18,7 +19,7 @@ namespace Microsoft.AspNetCore.SignalR.Tests
 {
     public class Startup
     {
-        private readonly SymmetricSecurityKey SecurityKey = new SymmetricSecurityKey(Guid.NewGuid().ToByteArray());
+        private readonly SymmetricSecurityKey SecurityKey = new SymmetricSecurityKey(SHA256.HashData(Guid.NewGuid().ToByteArray()));
         private readonly JwtSecurityTokenHandler JwtTokenHandler = new JwtSecurityTokenHandler();
 
         public void ConfigureServices(IServiceCollection services)