0factor 0.1.8

What's changed

• Default change under Aspire: AddZeroFactor now serves HTTPS when Aspire has a trusted ASP.NET Core developer certificate (dotnet dev-certs https --trust), like Aspire's Keycloak. The endpoint keeps its name (http) and port, so AddZeroFactor("auth", port: 7281) becomes https://localhost:7281. ZF_HOSTNAME, GetIssuer and WithReference(auth, realm: ...) follow automatically. Without a trusted certificate nothing changes.
• Opt out to stay on HTTP: builder.AddZeroFactor("auth", port: 7281).WithoutHttpsCertificate();. Do this if your apps hard-code http:// 0factor URLs instead of using WithReference or GetIssuer.
• Fix Blazor WebAssembly and oidc-client apps on https://localhost signing the user out seconds after sign-in. Over HTTPS the ZF_SESSION cookie is now SameSite=None; Secure like Keycloak's KEYCLOAK_IDENTITY, so session-status iframes and prompt=none renewals work cross-site. Over HTTP cookies stay SameSite=Lax.
• The Docker image still serves plain HTTP on 8080 by default. For HTTPS without Aspire, set Kestrel__Endpoints__https__Url=https://*:8080 and Kestrel__Endpoints__https__Certificate__Path/__KeyPath. TLS support adds about 3 MB to the image.

See PR #23 and the full changelog.

Install

dotnet add package ZeroFactor.Aspire.Hosting --version 0.1.8
docker pull c4l3b/0factor:0.1.8

0factor 0.1.7

What's changed

• Fix sign-in for browser-only OIDC clients such as oidc-client-js and Blazor WebAssembly. Discovery (/.well-known/openid-configuration), certs (/protocol/openid-connect/certs) and realm info (/realms/{realm}) now return Access-Control-Allow-Origin (the request origin) with Access-Control-Allow-Credentials: true, like Keycloak, instead of failing with "Network Error".
• Answer CORS preflights on those three endpoints, matching Keycloak's allowed methods.
• Pin MessagePack 2.5.303 in the hosting package to fix GHSA-qhrr-8q5h-9q3h, pulled in by Aspire.Hosting 13.4.6.

See PR #22 and the full changelog.

Install

dotnet add package ZeroFactor.Aspire.Hosting --version 0.1.7
docker pull c4l3b/0factor:0.1.7

0factor 0.1.6

What's changed

• Add a runnable ASP.NET Core sample with login, name and email display, and sign-out using standard OpenID Connect authentication. No realm import required.
• Lead the README with a simple AddZeroFactor setup, move Keycloak migration to its own section, and shorten repeated guidance.
• Test the sample's email-only and named registrations, persistent sessions, and sign-out against the real container.

See PR #21 and the full changelog.

Install

dotnet add package ZeroFactor.Aspire.Hosting --version 0.1.6
docker pull c4l3b/0factor:0.1.6

0factor 0.1.5

What's Changed

• Support CORS for browser OIDC clients by @c4l3b in #20

Full Changelog: v0.1.4...v0.1.5

0factor 0.1.4

• Container image now publishes to Docker Hub: docker run c4l3b/0factor. GHCR is no longer updated; v0.1.3 and earlier stay on ghcr.io.
• AddZeroFactor now pulls docker.io/c4l3b/0factor:<version>.

Full changes: v0.1.3...v0.1.4

0factor 0.1.3

• Restyled the login page as a centered card with user avatars and a shorter subtitle.
• Aspire hosting now derives a stable default port from the AppHost directory and resource name, preserving the issuer URL across restarts.
• Explicit ports remain supported; use port: null, isProxied: true for dynamically allocated ports.

Full changes: v0.1.2...v0.1.3

0factor 0.1.2

0factor 0.1.2 fixes login display names and dashboard links, and lets applications preserve existing identities when migrating from another mock OIDC provider.

• Login cards fall back to claims.name, then claims.given_name, when first and last names are absent.
• Verify native submit-button semantics and plain-form sign-in for user cards.
• Give existing unlabeled dashboard discovery links readable names such as shop discovery, without adding duplicate links.
• Add ZF_ISSUER to preserve the exact issuer in discovery and signed tokens, including root issuers and trailing slashes. Realm endpoint URLs continue to use ZF_HOSTNAME or the request URL.
• Document migration configuration and bump ZeroFactor.Aspire.Hosting to 0.1.2.

Migrating from a root-issuer mock

Set ZF_ISSUER to the exact old issuer and preserve imported user IDs to keep (iss, sub) identity keys. Configure your client's MetadataAddress to the realm discovery URL, for example http://localhost:8080/realms/shop/.well-known/openid-configuration, and keep issuer validation enabled. The override applies to every realm; use a single realm when preserving identities from another mock. See the migration guide.

Publishing this release triggers matching artifacts:

• Container: ghcr.io/c4l3b/0factor:0.1.2 (amd64 and arm64)
• NuGet: ZeroFactor.Aspire.Hosting 0.1.2

Validation: 80 .NET tests, including the Aspire container end-to-end flows; 6 iframe tests; Native AOT builds.

0factor is for local development only.

Full changelog

0factor 0.1.1

0factor 0.1.1 improves local authentication setup and Keycloak JavaScript compatibility.

• Support default keycloak-js session-status iframe checks, including detecting logout and account changes in other tabs, origin validation, and third-party cookie probes.
• Improve Aspire integration with browser-facing issuer URLs, realm-aware WithReference and GetIssuer, endpoint proxy control, and dashboard links.
• Pin or hide users on the login page.
• Support explicit lenient realm configuration and an audience shorthand for imported clients.
• Auto-submit form_post responses while retaining a working Continue button without JavaScript.
• Expand setup and migration documentation.

Publishing this release triggers matching container and NuGet package builds:

• Container: ghcr.io/c4l3b/0factor:0.1.1 (amd64 and arm64)
• NuGet: ZeroFactor.Aspire.Hosting 0.1.1

Browser cookie restrictions still apply to session-status iframes. 0factor is for local development only.

Full changelog