[Copilot]

Backporting #68645 to release/9.0

Extract IsAuthenticated helper method

Centralize IsAuthenticated implementation and use it in all places that need it.

Description

Some callsites didn't have an accurate implementation. So this is a bugfix. The check was also added in the past in servicing.

Fixes #68474

Customer Impact

A claims principal with multiple identities when the first identity is not authenticated but another identity is authenticated would have been considered as not authenticated. With the fix, we look at all identities and consider it authenticated when any identity is authenticated.

Regression?

No

Risk

Low. The change is straightforward and in an area that was touched in servicing in the past.

Verification

Automated. Added unit tests for that.

Packaging changes reviewed?

N/A

[Copilot]

Pull request overview

This PR backports a bugfix to release/9.0 that centralizes the “is authenticated” check into a shared SecurityHelper.IsAuthenticated(ClaimsPrincipal?) helper and updates call sites to use aggregate identity semantics (i.e., any authenticated identity qualifies), matching authorization behavior.

Changes:

• Add SecurityHelper.IsAuthenticated(ClaimsPrincipal?) with aggregate identity semantics.
• Replace primary-identity-only checks with the new helper in authorization, output caching, and Blazor server revalidation.
• Add unit tests covering multi-identity principals (including authenticated non-primary identity) for both the helper and output caching behavior.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/Shared/test/Shared.Tests/SecurityHelperTests.cs	Adds unit tests for SecurityHelper.IsAuthenticated including non-primary authenticated identity case.
src/Shared/SecurityHelper/SecurityHelper.cs	Introduces centralized IsAuthenticated helper using aggregate identity semantics.
src/Security/Authorization/Core/src/Microsoft.AspNetCore.Authorization.csproj	Links the shared SecurityHelper source into the Authorization assembly.
src/Security/Authorization/Core/src/DenyAnonymousAuthorizationRequirement.cs	Switches to SecurityHelper.IsAuthenticated to determine authenticated users.
src/Middleware/OutputCaching/test/OutputCachePolicyProviderTests.cs	Adds regression tests ensuring authenticated users (including via non-primary identity) are not cached.
src/Middleware/OutputCaching/src/Policies/DefaultPolicy.cs	Uses the helper for both request- and response-phase authenticated checks.
src/Middleware/OutputCaching/src/Microsoft.AspNetCore.OutputCaching.csproj	Links the shared SecurityHelper source into the OutputCaching assembly.
src/Components/Server/src/Microsoft.AspNetCore.Components.Server.csproj	Links the shared SecurityHelper source into the Components Server assembly.
src/Components/Server/src/Circuits/RevalidatingServerAuthenticationStateProvider.cs	Uses the helper for authentication detection before starting the revalidation loop.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.