Jun 5, 2026 · 7 min
MapInboundClaims and the bug class of invisible defaults
A JWT containing a `sub` claim arrived at the API. The handler read `nameidentifier`. Both fields existed because Microsoft's JWT library silently rewrote the claim names on the way in. This is a story about one default, and the broader bug class it belongs to.
Read more→