Truncate web.useragent sent to BankID in Auth/Sign/Payment API call. (#531)

* Truncate web.useragent sent to BankID in Auth/Sign/Payment API call, if the value exceeds the max length of 256 characters.
* Added test for truncating user agent string.

---------

Co-authored-by: Elin Fokine <ElinO@activesolution.se>

Author: elinohlsson

src/ActiveLogin.Authentication.BankId.Api/BankIdApiLimits.cs

@@ -0,0 +1,9 @@
+namespace ActiveLogin.Authentication.BankId.Api;
+
+public static class BankIdApiLimits
+{
+    /// <summary>
+    /// Max length for web.userAgent used in Auth/Sign/Payment as defined by the BankID API.
+    /// </summary>
+    public const int UserAgentMaxLength = 256;
+}

src/ActiveLogin.Authentication.BankId.AspNetCore/UserContext/Device/Resolvers/BankIdDefaultEndUserWebDeviceDataResolver.cs

@@ -42,6 +42,8 @@ private bool TryGetWebDeviceParameters(out DeviceDataWeb? parameters)
             return false;
         }
 
+        userAgent = TruncateUserAgent(userAgent);
+
         parameters = new DeviceDataWeb(
             referringDomain: referringDomain,
             userAgent: userAgent,
@@ -100,4 +102,11 @@ private bool TryGetHeader(string headerName, out string headerValue)
         return true;
     }
 
+    private static string TruncateUserAgent(string userAgent)
+    {
+        return userAgent.Length > BankIdApiLimits.UserAgentMaxLength
+            ? userAgent[..BankIdApiLimits.UserAgentMaxLength]
+            : userAgent;
+    }
+
 }

test/ActiveLogin.Authentication.BankId.AspNetCore.Test/UserContext/Device/Resolvers/BankIdDefaultEndUserWebDeviceDataResolver_Tests.cs

@@ -102,4 +102,34 @@ public void GetDeviceData_Returns_CreatedDeviceIdentifier()
         Assert.Equal(createdIdentifier, data.DeviceIdentifier);
     }
 
+    [Fact]
+    public void GetDeviceData_Truncates_UserAgent_When_Exceeding_MaxLength()
+    {
+        // Arrange
+        const string UserAgent330Characters =
+            "User-Agent: Mozilla/5.0 (Linux; Android 12; 2206122SC Build/SKQ1.220303.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 " +
+            "Chrome/86.0.4240.99 XWEB/4343 MMWEBSDK/20221011 Mobile Safari/537.36 MMWEBID/5638 MicroMessenger/8.0.30.2260(0x28001E3B) WeChat/arm64 " +
+            "Weixin NetType/WIFI Language/en ABI/arm64 MiniProgramEnv/android";
+
+        const string UserAgent256Characters =
+            "User-Agent: Mozilla/5.0 (Linux; Android 12; 2206122SC Build/SKQ1.220303.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 " +
+            "Chrome/86.0.4240.99 XWEB/4343 MMWEBSDK/20221011 Mobile Safari/537.36 MMWEBID/5638 MicroMessenger/8.0.30.2260(0x28001E3B) WeC";
+
+        var (sut, createdIdentifier) = CreateSut(
+            userAgent: UserAgent330Characters,
+            referer: _defaultReferer,
+            deviceIdentifier: _defaultDeviceIdentifier);
+
+        // Act
+        var data = sut.GetDeviceData() as DeviceDataWeb;
+
+        // Assert
+        Assert.NotNull(data);
+        Assert.Equal("example.se", data.ReferringDomain);
+        Assert.Equal(createdIdentifier, data.DeviceIdentifier);
+
+        Assert.NotNull(data.UserAgent);
+        Assert.Equal(256, data.UserAgent.Length);
+        Assert.Equal(UserAgent256Characters,data.UserAgent);
+    }
 }