Improve documentation on role or user change during SignalR connection lifetime

[cincuranet]

Fixes dotnet/aspnetcore#66718.

---

Internal previews

📄 File	🔗 Preview link
aspnetcore/signalr/authn-and-authz.md	customer intent: As an ASP.NET developer, I want to use authentication and authorization in ASP.NET Core SignalR, so I can verify user access to my apps.

[Copilot]

Pull request overview

This PR updates the SignalR authentication/authorization documentation to clarify how authorization behaves when a user’s roles/claims change after a SignalR connection is established.

Changes:

• Adds a new section explaining that SignalR caches the authenticated principal for the lifetime of a connection, so role/claim updates aren’t reflected on existing connections.
• Provides guidance on mitigation options (closing connections or performing “current data” checks).
• Updates the bearer-token section to reference the new guidance.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.

[BrennanConroy]

Content looks good, will leave it for the docs writers to review for flow and style.

[wadepickett]

...reviewing

[wadepickett]

Suggested change

On the next long-poll request, the authentication middleware might authenticate the user without the `Editor` role (for example, if roles are loaded from a data store or the cookie is refreshed). However, the hub continues to authorize the user's `[Authorize(Roles = "Editor")]` hub method invocations because `Context.User` (<xref:Microsoft.AspNetCore.SignalR.HubCallerContext.User?displayProperty=nameWithType>) still holds the principal that was cached before the role was removed. The user can keep calling `Editor`-only hub methods until the connection is closed.

On the next long-poll request, the authentication middleware might authenticate the user without the `Editor` role. For example, this can happen if roles are loaded from a data store or the cookie is refreshed. However, the hub continues to authorize the user's `[Authorize(Roles = "Editor")]` hub method invocations because `Context.User` (<xref:Microsoft.AspNetCore.SignalR.HubCallerContext.User?displayProperty=nameWithType>) still holds the principal that was cached before the role was removed. The user can keep calling `Editor`-only hub methods until the connection is closed.

Minor item: Breaking up into seperate sentances to improve readability.

[wadepickett]

Approved. Well done, looks great! I could only find a very minor item which I provided a suggestion for you inline.