Release v22.43.0

Changed

• Arc previously accepted unsigned x-ms-client-principal* identity headers from any caller; it now ignores them unless the host opts in. Requests remain anonymous unless another authentication scheme authenticates them. Apps behind a trusted EasyAuth or AuthProxy ingress retain the previous behavior with builder.AddCratis(options => options.TrustForwardedIdentityHeaders = true); or Cratis:Arc:TrustForwardedIdentityHeaders=true. See Migrating to secure defaults. (#2946)
• ASP.NET Core hosts calling AddMicrosoftIdentityPlatformIdentityAuthentication() (including through AddCratis()) without the opt-in receive a startup warning. The built-in header handlers also warn once per process when a request carries untrusted identity headers. (#2946)

Deprecated

• Cratis:Arc:Introspection:TrustForwardedIdentityHeaders is obsolete but still enables the host-wide trust setting. Move it to Cratis:Arc:TrustForwardedIdentityHeaders. (#2946)
• The three-argument MicrosoftIDentityPlatformAuthHandler constructor is obsolete but remains compatible with existing subclasses. Use the overload accepting IOptionsMonitor<ArcOptions>; the original constructor reads the host's trust setting from request services and defaults to untrusted when it is unavailable. (#2946)