Fixed bug 62257.

Author: Adit Sheth

src/Http/Authentication.Abstractions/src/TokenExtensions.cs

@@ -71,9 +71,9 @@ public static void StoreTokens(this AuthenticationProperties properties, IEnumer
     /// </summary>
     /// <param name="properties">The <see cref="AuthenticationProperties"/> to update.</param>
     /// <param name="tokenName">The token name.</param>
-    /// <param name="tokenValue">The token value.</param>
+    /// <param name="tokenValue">The token value. May be <c>null</c>.</param>
     /// <returns><see langword="true"/> if the token was updated, otherwise <see langword="false"/>.</returns>
-    public static bool UpdateTokenValue(this AuthenticationProperties properties, string tokenName, string tokenValue)
+    public static bool UpdateTokenValue(this AuthenticationProperties properties, string tokenName, string? tokenValue)
     {
         ArgumentNullException.ThrowIfNull(properties);
         ArgumentNullException.ThrowIfNull(tokenName);

src/Http/Authentication.Core/test/TokenExtensionTests.cs

@@ -1,9 +1,10 @@
 // Licensed to the .NET Foundation under one or more agreements.
 // The .NET Foundation licenses this file to you under the MIT license.
 
-using System.Security.Claims;
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.DependencyInjection;
+using System.Security.Claims;
+using static Microsoft.AspNetCore.Authentication.Core.Test.AuthenticationPropertiesTests;
 
 namespace Microsoft.AspNetCore.Authentication.Core.Test;
 
@@ -149,6 +150,64 @@ public async Task GetTokenWorksWithExplicitScheme()
         Assert.Equal("3", await context.GetTokenAsync("simple", "Three"));
     }
 
+    [Fact]
+    public void StoreTokensStoresTokensWithNullValues()
+    {
+        var properties = new AuthenticationProperties();
+        var tokens = new List<AuthenticationToken>
+        {
+            new AuthenticationToken { Name = "access_token", Value = "access_value" },
+            new AuthenticationToken { Name = "refresh_token", Value = null },
+            new AuthenticationToken { Name = "id_token", Value = "id_value" }
+        };
+
+        properties.StoreTokens(tokens);
+
+        Assert.Equal("access_value", properties.GetTokenValue("access_token"));
+        Assert.Null(properties.GetTokenValue("refresh_token"));
+        Assert.Equal("id_value", properties.GetTokenValue("id_token"));
+
+        var retrievedTokens = properties.GetTokens().ToList();
+        Assert.Equal(2, retrievedTokens.Count);
+        Assert.DoesNotContain(retrievedTokens, t => t.Name == "refresh_token");
+    }
+
+    [Fact]
+    public void UpdateTokenValueWorksWithNullGetTokenValueResult()
+    {
+        var sourceProperties = new AuthenticationProperties();
+        var targetProperties = new AuthenticationProperties();
+
+        var tokens = new List<AuthenticationToken>
+        {
+            new AuthenticationToken { Name = "refresh_token", Value = "refresh_value" }
+        };
+
+        targetProperties.StoreTokens(tokens);
+        targetProperties.UpdateTokenValue("refresh_token", sourceProperties.GetTokenValue("refresh_token"));
+        Assert.Null(targetProperties.GetTokenValue("refresh_token"));
+    }
+
+    [Fact]
+    public void GetTokensExcludesTokensWithNullValues()
+    {
+        var properties = new AuthenticationProperties();
+        var tokens = new List<AuthenticationToken>
+        {
+            new AuthenticationToken { Name = "access_token", Value = "access_value" },
+            new AuthenticationToken { Name = "refresh_token", Value = null },
+            new AuthenticationToken { Name = "id_token", Value = "id_value" }
+        };
+
+        properties.StoreTokens(tokens);
+        var retrievedTokens = properties.GetTokens().ToList();
+
+        Assert.Equal(2, retrievedTokens.Count);
+        Assert.Contains(retrievedTokens, t => t.Name == "access_token" && t.Value == "access_value");
+        Assert.Contains(retrievedTokens, t => t.Name == "id_token" && t.Value == "id_value");
+        Assert.DoesNotContain(retrievedTokens, t => t.Name == "refresh_token");
+    }
+
     private class SimpleAuth : IAuthenticationHandler
     {
         public Task<AuthenticateResult> AuthenticateAsync()