openiddict/openiddict-core 8.0.0-preview.3 on GitHub

This release introduces the following changes:

OpenIddict now supports dynamic resources stored in the database via the new IOpenIddictResourceManager<TResource>/IOpenIddictResourceStore<TResource> services. See #2450 for more information.
Initial support for sessions has been added in 8.0 preview 3. Sessions can be used to bind authorizations and tokens to a specific user login (typically stored as a stable, per-authentication claim in the authentication cookie) and will be leveraged in a future preview to implement native backchannel logout.

Note

These changes will require applying a schema update to add the new Resource and Session entities.

The Entity Framework Core, Entity Framework 6 and MongoDB stores and models have been deeply modernized by changing the type of some properties and removing a lot of workarounds that are no longer necessary with modern versions of EF Core. For more information, see:
- Modernize the Entity Framework Core models and stores.
- Modernize the MongoDB models and stores.

Note

As part of this change, the EF Core stores now use JSON operators in some of their methods: when testing OpenIddict 8.0 preview 3, make sure your database supports JSON queries.

OpenIddict now always flows the CancellationToken exposed by the ASP.NET Core and OWIN hosts but defers the signal to ensure a malicious actor cannot stop event handlers from being invoked by sending TCP RST packets immediately before sensitive operations are started. See #2516 for more information.

Tip

All the built-in event handlers have been updated to use context.CancellationToken. Developers writing custom event handlers are encouraged to also honor it when moving to OpenIddict 8.0 preview 3.

OpenIddict now exposes the IServiceProvider instance provided by the host via its events model. As part of this change, all the built-in scoped event handlers have been converted to singleton services to eliminate most of the per-request allocations caused by OpenIddict. Benchmarks show a significant reduction of 10% of the total allocations during a grant_type=password token request.
A regression introduced in the last preview that was affecting how user codes were generated was identified and fixed.
The GitHub web provider was fixed to support the iss parameter now returned by GitHub. As part of this change, the issuer was also changed to https://github.com/login/oauth, which is the value now officially used by GitHub.
The ReplaceDefault*Entity() methods exposed by OpenIddictMongoDbBuilder now register the stores as singleton services instead of scoped services.
The client system integration was updated to always attach an IASWebAuthenticationPresentationContextProviding object to the ASWebAuthenticationSession on Mac Catalyst and macOS, matching the logic already used on iOS (thanks @amirburbea for reporting this issue! ❤️).