JwtBearerEvents might be null, despite being marked as not null

[glatzert]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

The following code will throw a NullReferenceException:

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                .AddJwtBearer(o =>
                {
                    o.Events.OnMessageReceived += (ctx) => Task.CompletedTask;
                });

It will do so despite o.Events being flagged as not nullable.

Expected Behavior

o.Events is not null

Steps To Reproduce

No response

Exceptions (if any)

No response

.NET Version

6.0.400

Anything else?

aspnetcore/src/Security/Authentication/JwtBearer/src/JwtBearerOptions.cs

Lines 57 to 66 in cccab50

	/// <summary>
	/// The object provided by the application to process events raised by the bearer authentication handler.
	/// The application may implement the interface fully, or it may create an instance of JwtBearerEvents
	/// and assign delegates only to the events it wants to process.
	/// </summary>
	public new JwtBearerEvents Events
	{
	get { return (JwtBearerEvents)base.Events!; }
	set { base.Events = value; }
	}

This should probably have JwtBearerEvents?

[Tratcher]

You're correct, the base Events field is nullable and so should this one be. Note this applies to all auth handlers.

aspnetcore/src/Security/Authentication/Core/src/AuthenticationSchemeOptions.cs

Line 33 in cccab50

public object? Events { get; set; }

Events will be initialized to a default value later if one is not provided.

aspnetcore/src/Security/Authentication/Core/src/AuthenticationHandler.cs

Line 154 in c85baf8

Events ??= await CreateEventsAsync();

[akonyer]

I'm running into this as well. For now just have to null check it even though the compiler tells me you shouldn't have to