Implements Nonce generation and saving to cache

[erkkiarus]

• Marked GetAndRemoveImpl method as obsolete in IChallengeNonceStore interface;
• Moved InMemoryChallengeNonceStore class from Tests WebEid.Security project;
• Added ChallengeNonceGeneratorBuilder class;
• Added missing members' documentation comments.

Signed-off-by: Erkki Arus erkki@raulwalter.com

[mrts]

We cannot merge this for the following reasons:

• IChallengeNonceStore.GetAndRemoveImpl() is intentional and must remain. IChallengeNonceStore.GetAndRemove() is a template method that defines the common steps that all implementations must perform and it relies on the GetAndRemoveImpl() helper method, that the implementations have to implement, to do the implementation-specific actual work. See this Wikipedia article about the Template Method pattern and this implementation from the Web eID ASP.NET example for an correct session-backed implementation of IChallengeNonceStore. This is also explained in the README.
• InMemoryChallengeNonceStore can only be used in tests. The website backend must lookup the challenge nonce from its local store using an identifier specific to the browser session, to guarantee that the authentication token was received from the same browser to which the corresponding challenge nonce was issued. InMemoryChallengeNonceStore does not guarantee this. Moreover, as it uses a single shared field for accessing and storing the nonce in a non-thread-safe way, it is in general unsuitable for using in multi-threaded multi-user web applications.

But thanks for fixing the tests and adding the ChallengeNonceGeneratorBuilder!

[erkkiarus]

IChallengeNonceStore is declared as an interface, not as an abstract class. Interface is not place where define any method.