Reduce string allocations by comparing issuers in-place

src/Microsoft.IdentityModel.Validators/AadIssuerValidator/AadIssuerValidator.cs

@@ -13,7 +13,6 @@
 using Microsoft.IdentityModel.Protocols;
 using Microsoft.IdentityModel.Protocols.OpenIdConnect;
 using Microsoft.IdentityModel.Tokens;
-using static Microsoft.IdentityModel.Validators.AadIssuerValidator;
 
 namespace Microsoft.IdentityModel.Validators
 {
@@ -281,7 +280,7 @@
             }
 
             // If a valid issuer is not found, throw
             throw LogHelper.LogExceptionMessage(
                 new SecurityTokenInvalidIssuerException(
                     LogHelper.FormatInvariant(
                         LogMessages.IDX40001,
@@ -390,14 +389,62 @@
 
             if (validIssuerTemplate.Contains(TenantIdTemplate))
             {
-                return validIssuerTemplate.Replace(TenantIdTemplate, tenantId) == actualIssuer;
+                return IssuersWithTemplatesAreEqual(validIssuerTemplate, TenantIdTemplate, actualIssuer, tenantId);
             }
             else
             {
                 return validIssuerTemplate == actualIssuer;
             }
         }
 
+        /// <summary>
+        /// Compare two Issuers with templates without string allocations.
+        /// </summary>
+        internal static bool IssuersWithTemplatesAreEqual(string issuer1, string issuer1Template, string issuer2, string issuer2Template)
+        {
+            int firstHalfIssuer1EndIndex = issuer1.IndexOf(issuer1Template, StringComparison.Ordinal);
+            int firstHalfIssuer2EndIndex = issuer2.IndexOf(issuer2Template, StringComparison.Ordinal);
+
+            // ensure indices exist for both issuers
+            if (firstHalfIssuer1EndIndex == -1  || firstHalfIssuer2EndIndex == -1)
+                return false;
+
+            // if the indices aren't equal, then the issuers aren't equal
+            if (firstHalfIssuer1EndIndex != firstHalfIssuer2EndIndex)
+                return false;
+
+            // ensure the first part of the issuer1 matches the first part of issuer2
+            if (!StringSegmentsAreEqual(issuer1, 0, firstHalfIssuer1EndIndex, issuer2, 0, firstHalfIssuer2EndIndex))
+                return false;
+
+            int secondHalfIssuer1StartIndex = firstHalfIssuer1EndIndex + issuer1Template.Length;
+            int secondHalfIssuer2StartIndex = firstHalfIssuer2EndIndex + issuer2Template.Length;
+
+            // if the indices aren't equal, then the issuers aren't equal
+            if (secondHalfIssuer1StartIndex != secondHalfIssuer2StartIndex)
+                return false;
+
+            // ensure the second halves are equal
+            if (!StringSegmentsAreEqual(issuer1, secondHalfIssuer1StartIndex, issuer1.Length, issuer2, secondHalfIssuer2StartIndex, issuer2.Length))
+                return false;
+
+            return true;
+        }
+
+        /// <summary>
+        /// Compare two string segments for equality without string allocations.
+        /// </summary>
+        private static bool StringSegmentsAreEqual(string str1, int str1Start, int str1End, string str2, int str2Start, int str2End)
+        {
+            for (int i = str1Start, j = str2Start; i < str1End && j < str2End; i++, j++)
+            {
+                if (str1[i] != str2[j])
+                    return false;
+            }
+
+            return true;
+        }
+
         private void SetEffectiveLKGIssuer(string aadIssuer, ProtocolVersion protocolVersion, TimeSpan lastKnownGoodLifetime)
         {
             var issuerLKG = new IssuerLastKnownGood

src/Microsoft.IdentityModel.Validators/AadTokenValidationParametersExtension.cs

@@ -77,25 +77,20 @@ internal static bool ValidateIssuerSigningKey(SecurityKey securityKey, SecurityT
                 if (!string.IsNullOrEmpty(tokenIssuer) && !tokenIssuer.Contains(tenantIdFromToken, StringComparison.Ordinal))
                     throw LogHelper.LogExceptionMessage(new SecurityTokenInvalidIssuerException(LogHelper.FormatInvariant(LogMessages.IDX40004, LogHelper.MarkAsNonPII(tokenIssuer), LogHelper.MarkAsNonPII(tenantIdFromToken))));
 
-                // creating an effectiveSigningKeyIssuer is required as signingKeyIssuer might contain {tenantid}
-                var effectiveSigningKeyIssuer = signingKeyIssuer.Replace(AadIssuerValidator.TenantIdTemplate, tenantIdFromToken, StringComparison.Ordinal);
-                var v2TokenIssuer = openIdConnectConfiguration.Issuer?.Replace(AadIssuerValidator.TenantIdTemplate, tenantIdFromToken, StringComparison.Ordinal);
 #else
                 if (!string.IsNullOrEmpty(tokenIssuer) && !tokenIssuer.Contains(tenantIdFromToken))
                     throw LogHelper.LogExceptionMessage(new SecurityTokenInvalidIssuerException(LogHelper.FormatInvariant(LogMessages.IDX40004, LogHelper.MarkAsNonPII(tokenIssuer), LogHelper.MarkAsNonPII(tenantIdFromToken))));
 
-                // creating an effectiveSigningKeyIssuer is required as signingKeyIssuer might contain {tenantid}
-                var effectiveSigningKeyIssuer = signingKeyIssuer.Replace(AadIssuerValidator.TenantIdTemplate, tenantIdFromToken);
-                var v2TokenIssuer = openIdConnectConfiguration.Issuer?.Replace(AadIssuerValidator.TenantIdTemplate, tenantIdFromToken);
 #endif
 
                 // comparing effectiveSigningKeyIssuer with v2TokenIssuer is required as well because of the following scenario:
                 // 1. service trusts /common/v2.0 endpoint 
                 // 2. service receieves a v1 token that has issuer like sts.windows.net
                 // 3. signing key issuers will never match sts.windows.net as v1 endpoint doesn't have issuers attached to keys
                 // v2TokenIssuer is the representation of Token.Issuer (if it was a v2 issuer)
-                if (effectiveSigningKeyIssuer != tokenIssuer && effectiveSigningKeyIssuer != v2TokenIssuer)
-                    throw LogHelper.LogExceptionMessage(new SecurityTokenInvalidIssuerException(LogHelper.FormatInvariant(LogMessages.IDX40005, LogHelper.MarkAsNonPII(tokenIssuer), LogHelper.MarkAsNonPII(effectiveSigningKeyIssuer))));
+                if (!AadIssuerValidator.IssuersWithTemplatesAreEqual(signingKeyIssuer, tenantIdFromToken, tokenIssuer, tenantIdFromToken)
+                        && !AadIssuerValidator.IssuersWithTemplatesAreEqual(signingKeyIssuer, tenantIdFromToken, openIdConnectConfiguration.Issuer ?? string.Empty, tenantIdFromToken))
+                    throw LogHelper.LogExceptionMessage(new SecurityTokenInvalidIssuerException(LogHelper.FormatInvariant(LogMessages.IDX40005, LogHelper.MarkAsNonPII(tokenIssuer), LogHelper.MarkAsNonPII(openIdConnectConfiguration.Issuer))));
             }
 
             return true;