From e6792aee954fe547fba63efef29b169b17a9bf96 Mon Sep 17 00:00:00 2001
From: Oliver Kieselbach <oliver.kieselbach@outlook.com>
Date: Wed, 20 May 2026 20:09:10 +0200
Subject: [PATCH] added entra upcoming valid algorithm

---
 .../Middleware/AuthenticationMiddleware.cs                   | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/Backend/AutopilotMonitor.Functions/Middleware/AuthenticationMiddleware.cs b/src/Backend/AutopilotMonitor.Functions/Middleware/AuthenticationMiddleware.cs
index 0a2fb914..b2099376 100644
--- a/src/Backend/AutopilotMonitor.Functions/Middleware/AuthenticationMiddleware.cs
+++ b/src/Backend/AutopilotMonitor.Functions/Middleware/AuthenticationMiddleware.cs
@@ -217,8 +217,9 @@ public class AuthenticationMiddleware : IFunctionsWorkerMiddleware
                     return matchedKeys.Any() ? matchedKeys : openIdConfig.SigningKeys;
                 },
 
-                // Set algorithm validators to ensure we only accept RS256
-                ValidAlgorithms = new[] { "RS256" }
+                // Algorithm whitelist: RS256 today, PS256 for Entra's announced rollout.
+                // Hard-blocks HS-family and "none" (algorithm-confusion defence).
+                ValidAlgorithms = new[] { "RS256", "PS256" }
             };
 
             var principal = _tokenHandler.ValidateToken(token, validationParameters, out var validatedToken);