OpenIddict.Abstractions

This release introduces the following changes:

• The GitHub web provider was fixed to support the iss parameter now returned by GitHub. As part of this change, the issuer was also changed to https://github.com/login/oauth, which is the value now officially used by GitHub.

• The ReplaceDefault*Entity() methods exposed by OpenIddictMongoDbBuilder now register the stores as singleton services instead of scoped services.

• The client system integration was updated to always attach an IASWebAuthenticationPresentationContextProviding object to the ASWebAuthenticationSession on Mac Catalyst and macOS, matching the logic already used on iOS (thanks @amirburbea for reporting this issue).

This release introduces the following changes:

• The Entity Framework 6.x and Entity Framework Core stores have been updated to automatically restore the EntityState of token entities after failed application deletion (thanks @tedchirvasiu! ❤️)

• The OpenIddict.Client.WebIntegration package now supports Vercel and ID Austria (thanks @kescherCode! ❤️)

• All the .NET and third-party dependencies have been updated to their latest version.

await using (var scope = app.Services.CreateAsyncScope())
{
    // Revoke all the existing tokens, independently of their current status or type.
    //
    // Note: on EF Core 8.0+ and MongoDB, the process should be very efficient as batch
    // updates are used by default to change the status of the tokens in the database.
    var manager = scope.ServiceProvider.GetRequiredService<IOpenIddictTokenManager>();
    await manager.RevokeAsync(subject: null, client: null, status: null, type: null);
}

This release introduces the following changes:

• The ClaimTypes.NameIdentifier, ClaimTypes.Name and ClaimTypes.Email WS-Federation claims manually added to ProcessAuthenticationContext.MergedPrincipal are now preserved instead of being overwritten by OpenIddict when mapping OpenID Connect/non-standard claims to their WS-Federation equivalent (thanks @ax0l0tl! ❤️)

• The net8.0, net9.0 and net10.0 versions of the OpenIddict.Client.DataProtection, OpenIddict.Server.DataProtection and OpenIddict.Validation.DataProtection packages now reference the Microsoft.AspNetCore.DataProtection package instead of the Microsoft.AspNetCore.App framework.

• Configuration delegates registered by the web provider integrations now run earlier to ensure invalid options are caught without waiting for IOptionsMonitor<OpenIddictClientOptions>.CurrentValue to be called.

• All the .NET and third-party dependencies have been updated to their latest version.

This release introduces the following changes:

• The new mTLS-based OAuth 2.0 client authentication feature introduced in the previous version can now be used with the standard client credentials grant.

• The mTLS token binding implementation was updated to support anonymous clients (in this case, the base SelfSignedTlsClientAuthenticationPolicy instance attached to the server options is directly used and the IOpenIddictApplicationManager.GetSelfSignedTlsClientAuthenticationPolicyAsync()/IOpenIddictApplicationManager.ValidateSelfSignedTlsClientCertificateAsync() APIs are not used).

• The OpenIddict.Client.SystemIntegration package now restores the ambient request for marshalled authentication demands so that the OpenIddictRequest instance can be accessed from a custom event handler during a call to the AuthenticateInteractivelyAsync() method.

• A new DisableIssuerParameterValidation flag was introduced to allow disabling the built-in logic used to validate the iss authorization response parameter. Due to #2428, this flag is set to true for the Google provider for now.

This release introduces the following changes:

• Mutual TLS authentication is now fully supported by the server and validation stacks for both OAuth 2.0 client authentication and token binding (mTLS support in the client stack was introduced in OpenIddict 6.0). For more information on how to set up mTLS, read Mutual TLS authentication.

• Client secrets are still fully supported but the XML documentation was updated to discourage using them when possible. Instead, developers are encouraged to use either assertion-based client authentication or mTLS-based client authentication, as both offer a higher security level than shared secrets.

• Client-side mTLS support was moved from OpenIddict.Client.SystemNetHttp to OpenIddict.Client and is now a first-class citizen. As part of this task, the existing TlsClientAuthenticationCertificateSelector and SelfSignedTlsClientAuthenticationCertificateSelector options present in OpenIddictClientSystemNetHttpOptions and OpenIddictValidationSystemNetHttpOptions have been marked as deprecated and are no longer used as they didn't allow flowing certificates dynamically (which is required for mTLS token binding using certificates generated on-the-fly). Instead, developers who need to dynamically override the default TLS client certificates selection logic are now invited to create custom event handlers for the ProcessAuthenticationContext event and use the new *EndpointClientCertificate properties.

• OpenIddictClientService now allows attaching custom token request parameters via InteractiveAuthenticationRequest.AdditionalTokenRequestParameters. As part of this change, handling of redirection and post-logout redirection requests by the OpenIddict.Client.SystemIntegration has been improved: token and userinfo requests are no longer sent as part of the callback request itself but when OpenIddictClientService.AuthenticateInteractivelyAsync() is called by the application to finalize the authentication process.

• OpenIddict now uses 4096-bit RSA keys for development certificates and ephemeral keys (see #2415 for more information).

• A new token validation check has been introduced in the client, server and validation stacks to detect when the payload associated with a reference token entry - stolen by a malicious actor from the server database - is directly used instead of the expected reference identifier.

• The osu! service is now supported by the OpenIddict.Client.WebIntegration package (thanks @gehongyan! ❤️).

• A dedicated prompt setting was added to the Google web provider (thanks @StellaAlexis! ❤️).

• An incorrect exception message reference was fixed (thanks @JarieTimmer! ❤️)

• The entire code base was updated to use polyfills when targeting older .NET/.NET Framework/.NET Standard targets.

• All the .NET and third-party dependencies have been updated to the latest versions.

This release introduces the following changes:

• Following today's .NET 10.0 release, all the OpenIddict packages now offer a .NET 10.0 target framework moniker referencing .NET Extensions packages version 10.0.

• OpenIddict.Client.WebIntegration now supports Figma.

• The net8.0-android34.0, net8.0-ios18.0, net8.0-maccatalyst18.0 and net8.0-macos15.0 target framework monikers are no longer supported by Microsoft and have been removed from the OpenIddict.Client.SystemIntegration package and the OpenIddict metapackage. Users of the OpenIddict.Client.SystemIntegration package are invited to migrate to .NET 9.0 or 10.0.

• The OpenIddict*Manager.UpdateAsync() methods have been updated to remove cached entries before calling Store.UpdateAsync() to ensure entities are always removed even when the inner store throws an exception.

This release introduces the following changes:

• The GitHub web provider was updated to enforce OAuth 2.0 Proof Key for Code Exchange for all client registrations.

• The HeyBoxChat service is now supported by the OpenIddict.Client.WebIntegration package (thanks @gehongyan! ❤️)

• New AddGrantTypePermissions()/RemoveGrantTypePermissions() APIs have been added to OpenIddictApplicationDescriptor to simplify adding and removing grant type permissions for custom grants:

var descriptor = new OpenIddictApplicationDescriptor
{
    ClientId = "console",

    // ...
};

descriptor.AddGrantTypePermissions("custom_grant_type");
descriptor.AddScopePermissions("demo_api");

• All the .NET and third-party dependencies have been updated to the latest versions.