[maartenba]

No description provided.

[Copilot]

🟡 Changes recommended

The documentation incorrectly implies that assigning any data protection provider bypasses partitioning; the exemption needs to be limited to independently created providers to avoid misleading readers about cross-space cookie readability.

1 open issue

• Clarify that only independently created providers bypass partitioning · New

What changed in this PR

This documentation update explains Spaces’ resolution caching and how per-space Data Protection behaves at runtime.

Changes:

• Documents resolution-cache expiration options, defaults, and visibility of changes across instances.
• Adds guidance on Data Protection partitioning, Default space fallback, provider scope, and registration requirements.
• Links the getting-started guide to the new Data Protection page.

File	Description
astro/​src/​content/​docs/​identityserver/​spaces/​getting-started.md	Adds cache lifetime guidance and links to detailed Data Protection documentation.
astro/​src/​content/​docs/​identityserver/​spaces/​data-protection.md	Adds runtime behavior, fallback monitoring, and provider configuration guidance.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The docs-only snapshot lacks the Duende.Spaces implementation needed to verify the security-sensitive decryption fallback, provider-registration checks, and cross-instance cache visibility guarantees.

No open issues 🎉

1 resolved since last review

• Clarify that only independently created providers bypass partitioning

_{Review effort: Balanced}

[maartenba]

These claims were checked against the code in the released packages (Duende.Spaces 1.0.0-preview.6, tag spaces-1.0.0-preview.6):

• Decryption fallback: SpacePartitionedDataProtector retries with the unpartitioned purpose chain only when unprotecting throws CryptographicException and the space is SpaceId.Default. Protect has no fallback. Each fallback records duende.spaces.data_protection.default_space_fallback (SpacesTelemetryConstants). With no resolved space it throws InvalidOperationException with the quoted message.
• Provider registration checks: SpacesDataProtectionRegistration wraps only the last non-keyed IDataProtectionProvider and rejects a scoped registration. UseSpaceResolution() calls SpacesDataProtectionValidation.Validate, which throws when the provider was registered or replaced after AddSpaces() or registered more than once.
• Cache visibility: SpacesOptions.LocalCacheExpiration (30 s) and Expiration (30 min) are passed to HybridCache in SpaceStore and SpaceRouting. Writes in SpaceRepository call HybridCache.RemoveAsync, so other instances pick up a change once their in-process entry expires. I tightened the Getting Started wording to match in 2cf3e95 ("after at most LocalCacheExpiration" instead of "up to these lifetimes").

[Copilot]

🔵 Needs a closer look

The snapshot lacks the Spaces implementation or tests needed to verify the security-sensitive fallback, provider-validation guarantees, and stated cross-instance cache propagation bound.

No open issues 🎉

_{Review effort: Balanced}

[StuFrankish]

Add a warning note re-itterating that once a host has run with PartitionDataProtection enabled (which it is by default), it must not be turned off as the previously partitioned data will become unreadable.

[maartenba]

@StuFrankish there you go

[Copilot]

🔵 Needs a closer look

The docs checkout lacks the Spaces implementation needed to verify the cryptographic fallback, provider-registration validation, and cross-instance cache-visibility guarantees.

No open issues 🎉

_{Review effort: Balanced}