This release introduces the following changes:
- A vulnerability affecting the validation of audiences contained in client assertions by the OpenIddict server stack was identified earlier today (thanks @x-redacted! ❤️) and fixed.
Caution
Upgrading to OpenIddict 7.7 or 8.0 preview 4 is strongly advised. See GHSA-925x-4h4v-2792 for more information.
- On .NET 10 and higher, the
OpenIddict.Quartzpackage now references the 4.0 version of Quartz.NET. See https://www.quartz-scheduler.net/documentation/quartz-4.x/migration-guide.html for more information about Quartz.NET 4.0.
Important
On .NET Framework, the package keeps referencing the 3.x branch, as Quartz.NET 4.0 is only compatible with .NET 10 and higher.
-
The
audclaim in client assertions can now be represented as a JSON array, as allowed by the recent versions of the Updates to OAuth 2.0 JSON Web Token (JWT) Client Authentication and Assertion-Based Authorization Grants specification. -
The
OpenIddict.Client.WebIntegrationpackage now supports JoinRpg (thanks @leotsarev! ❤️) -
grant_type=urn:ietf:params:oauth:grant-type:device_codetoken requests that don't include a client identifier are now rejected earlier by the OpenIddict server stack. -
For consistency with IdentityModel's validation routine, the "skip audience/presenter validation when no specific audience/presenter is expected" logic was removed from the
ValidateAudiences/ValidatePresentersevent handlers: advanced users using the events model to customize the token validation logic are invited to manually setDisableAudienceValidation/DisablePresenterValidationtotruewhen no check should be performed.