Skip to content
This repository has been archived by the owner on Nov 19, 2024. It is now read-only.

3.0.0
Compare
Choose a tag to compare
@josephdecock josephdecock released this 12 Aug 21:50
· 14 commits to main since this release
3.0.0
b0f2ac0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Learn about vigilant mode.

This is a major release of Duende.AccessTokenManagement and Duende.AccessTokenManagement.OpenIdConnect. Highlights include

  • Improved support for Blazor Server
  • Updates to dependencies
  • Bug fixes and improvements

Breaking Changes

  • Support for .NET 6 and 7 has been dropped, as Microsoft either no longer supports or soon will no longer support those versions in the coming months. Duende.AccessTokenManagement Version 2.1 (which supports .NET 6 and 7) will continue to be supported until .NET 6 reaches end of life in November.
  • The OpenIdConnectUserAccessTokenHandler no longer depends on HttpContext, and instead depends on the new IUserAccessor interface. This change allows us to use the handler in Blazor Server projects. If you have customized the handler in a derived class, update your derived class's constructor to depend on the IUserAccessor and pass that to the handler's constructor. You probably don't need to implement IUserAccessor - the default implementation of the IUserAccessor is registered automatically and accesses the current user from the HttpContext, and a blazor server specific implementation is also available.
  • The OpenIdConnectUserAccessTokenHandler also now takes a direct dependency on the IUserTokenManagementService, rather than resolving it from the HttpContext. Again, if you have customized the handler in a derived class, you'll need to update constructors.

Blazor Server Support

This release improves our support for Blazor Server. We've added a new method to use when registering services: AddBlazorServerAccessTokenManagement. This method sets up dependencies needed specifically in a Blazor Server environment, including retrieving the current user without using HttpContext when it is not available. This simplifies creating HttpClients that use the current user's access token.

Blazor Server implementations have always required a server side token store (an implementation of ITokenStore). You should pass your implementation of ITokenStore to AddBlazorServerAccessTokenManagement's type parameter.

We've also exposed the logic related to storage of tokens in an AuthenticationTicket as a new service.

Dependencies

  • We now depend on:
    • version 7.0.0 or later of IdentityModel
    • version 8.0.1 or later of the ASP.NET OpenIdConnect Authentication Handler (Microsoft.AspNetCore.Authentication.OpenIdConnect)
    • version 7.1.2 or later of the Microsoft JWT Handler (System.IdentityModel.Tokens.Jwt)

Our approach for dependencies is to depend on the minimum patch version that accomplishes
the following:

  • Avoid depending on a version of a package that has a known security vulnerability
  • Avoid depending on a version that has a transitive dependency on a version of a package that has a known vulnerability
  • Depend on the same version of the Microsoft JWT handler as the ASP.NET OpenIdConnect Authentication Handler

Full Changelog

Blazor Support

Bugs and Improvements

Dependencies

  • Updated System.IdentityModel.Tokens.Jwt and Microsoft.IdentityModel.JsonWebTokens to latest to address CVEs by @chgl in #53
  • Updateed System.IdentityModel.Tokens.Jwt and Microsoft.AspNetCore.Authentication.* by @josephdecock in #92
  • Update IdentityModel to v7.0.0 by @josephdecock in #93
  • Drop support for .NET 6/7 by @josephdecock in #98

Dependabot

New Contributors

Full Changelog: 2.1.2...3.0.0

Contributors

paulomorgado, josephdecock, and 8 other contributors
Assets 2
Loading