Skip to content

Release v2.22.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Sep 08:32
v2.22.1
f24947d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixed

  • The legacy identity path no longer reuses a cached identity for an unidentifiable principal. IdentityAccountBinding.TryCreate now fails closed when the legacy UserId is empty, whitespace, or untrimmed (mirroring the canonical path's guard), so such a principal never becomes a shared key into the process-wide identity IMemoryCache/semaphore and always resolves fresh. This closes a cross-user identity leak where two unidentifiable principals in the same tenant could be served each other's identity.
Assets 2
Loading