Repository navigation
Releases
11.1.0
11.0.4 (2026-11-11)
Security Fixes
- apply CVE-2026-114147 fix by updating Microsoft.AspNetCore.SignalR.StackExchangeRedis depency
11.0.4
11.0.4 (2026-11-05)
Security Fixes
News options are available to control dynamic client registration:
By default, clients created by dynamic registration are protected as follows:
- A native application using only the
authorization_codeandrefresh_tokengrant types is a public client: it has no client secret requirement, and PKCE is required. - Any other client (web applications, or clients using other grant types such as
client_credentials) must authenticate at the token endpoint. - PKCE is required for every client using the
authorization_codegrant type. - A web client using the authorization code flow must register
httpsredirect URIs.httpis accepted only for loopback hosts (localhost,127.0.0.1,[::1]).
Web clients using the implicit grant type must still use https redirect URIs and cannot use localhost, and native clients keep their own redirect URI rules.
You can adjust these protections with the following options.
| Option | Default | Description |
|---|---|---|
| RequirePkce | Always |
Always: PKCE is required for all clients using the authorization code flow. PublicClientsOnly: PKCE is required only for public clients. Never: PKCE is never required. |
| RequireClientAuthentication | true |
When false, no client created by dynamic registration is required to authenticate at the token endpoint (all clients are public). |
| RequireHttpsRedirectUris | true |
When false, web clients using the authorization code flow can register http redirect URIs. |
| AllowLoopbackHttpRedirectUris | true |
When RequireHttpsRedirectUris is true, accepts http redirect URIs on loopback hosts. |
"DynamicClientRegistrationOptions": {
"RequirePkce": "PublicClientsOnly",
"RequireClientAuthentication": true,
"RequireHttpsRedirectUris": true,
"AllowLoopbackHttpRedirectUris": true
}The server logs a warning at startup when one of these options is relaxed.
Without PKCE and client authentication, an authorization code intercepted by an attacker can be exchanged with only the client identifier. Keep the default values unless you need to accept clients that can't support them, for example to run a conformance test suite that doesn't send a PKCE code challenge.
These options apply when a client is registered or updated. Clients created before the upgrade keep their settings, check clients created by dynamic registration that have RequirePkce or RequireClientSecret set to
falseand use theauthorization_codegrant type.
11.0.3
11.0.2
11.0.2 (2026-09-13)
Bug Fixes
- security: escape OData filter literals to prevent unauthenticated filter injection (GHSA-hrqg-j45w-mx92) (63d7f46)
- filter backchannel authentication requests by client id (17e314c)
- restore empty string literal for null OData filter values (58b6e4c)
- docker: update nginx base image to patched version (c267c8a)
11.0.1
11.0.0
10.0.4
10.0.3
10.0.2
10.0.2 (2026-02-13)
CVE-2026-21218 | .NET Security Feature Bypass Vulnerability security patch