Prerequisites

• I have written a descriptive pull-request title
• I have verified that there are no overlapping pull-requests open
• I have verified that I am following matches the existing coding patterns and practice as demonstrated in the repository. These follow strict Stylecop rules 👮.
• I have provided test coverage for my change (where applicable)

Description

As mentioned in https://github.com/SixLabors/ImageSharp.Web/pull/250/files#r857755086, caching generated HMACs based on the token completely bypasses the validation, because the cache key doesn't change when the commands are changed and therefore returns the same valid HMAC when the token is used with different commands.

I've thought about creating a better key for the HMAC cache, but that would also require additional processing and you might get similar issues when that cache key doesn't use the same information as OnComputeHMACAsync does (e.g. the HMAC cache key uses a relative URL, but the HMAC is computed using an absolute URL).

The overhead of generating HMACs is also relatively low and attackers could otherwise just change the URL slightly to bypass the cached HMACs anyway. This is why I think completely removing the HMAC cache seems like the most reasonable fix.

You can quickly test this by using the following code and appending &hmac= with the logged value:

using System.Security.Cryptography;
using Microsoft.AspNetCore.Http.Extensions;

services.AddImageSharp(options =>
{
    // Randomly generate a HMAC secret key
    byte[] secret = new byte[64];
    RandomNumberGenerator.Create().GetBytes(secret);
    options.HMACSecretKey = secret;

    // Log computed HMAC to console for testing
    var onComputeHMACAsync = options.OnComputeHMACAsync;
    options.OnComputeHMACAsync = async (context, secret) =>
    {
        var hmac = await onComputeHMACAsync(context, secret);

        Console.WriteLine($"Computed HMAC for {context.Context.Request.GetDisplayUrl()}: {hmac}");

        return hmac;
    };
});