Kontent.Ai.AspNetCore 1.0.0-rc.1

Targets .NET 10, moving from net8.0 to net10.0. Webhook signature verification is hardened in two ways
worth reading before you upgrade, and the public surface is tightened while the package is still pre-1.0:
types are sealed, the webhook payload models become immutable records, and two dependency-injected values
stop being public properties.

Breaking changes

• Every public type is sealed, and the webhook payload models are records with init properties. WebhookNotification, WebhookModel, WebhookData, WebhookMessage and WebhookItem describe an inbound payload: nothing mutates one after it is bound, and comparing two by value is more often what you want than comparing by reference. Each keeps its public parameterless constructor, so System.Text.Json binds them exactly as before, and property names and JSON attributes are unchanged. Code that constructs one with an object initializer still compiles; code that assigns a property after construction does not.
• Reference is removed. A public model with ById / ByCodename / ByExternalId factories that nothing in the package produced, consumed, or referenced — it was reachable only from its own unit test.
• SignatureMiddleware.WebhookOptions and AssetTagHelper.ImageTransformationOptions are no longer public properties. Both were dependency-injected values exposed for no scenario. The middleware's carried the shared webhook secret. The tag helper's was worse than redundant: Razor binds every public settable property on a tag helper to an HTML attribute unless told otherwise, so <img-asset> accepted an image-transformation-options attribute that was never meant to exist. Both are now constructor parameters held privately.
• UseWebhookSignatureValidator no longer takes an optional WebhookOptions. Three overloads accepting reference types meant UseWebhookSignatureValidator(predicate, null) could not be resolved. "Use the options from the container" is now its own two-argument overload, and the WebhookOptions overload takes a required, non-null instance. Calls that passed options, an Action<WebhookOptions>, a configuration section, or nothing at all are unaffected.
• net8.0 → net10.0. There is no multi-targeting, so a project on .NET 8 cannot install this release at all — restore fails with NU1202: Package Kontent.Ai.AspNetCore is not compatible with net8.0. Move to .NET 10 first. This is a pre-1.0 package, so the minor version carries the break.

Security

• Webhook signatures are compared in constant time. The check compared the Base64 signature strings with an ordinary ordinal comparison, which returns as soon as two characters differ. A caller able to time the response could recover the expected signature one character at a time and forge a request. The comparison now runs over the raw HMAC bytes via CryptographicOperations.FixedTimeEquals. A signature that is not well-formed Base64, or that does not decode to exactly one HMAC-SHA256 digest, is rejected before any comparison — digest length is fixed, so rejecting on length leaks nothing.

• A missing webhook secret now fails loudly instead of accepting requests. With WebhookOptions.Secret unset, the middleware hashed the body with an empty key and compared against that, so anything signed with the same empty key passed validation — a misconfigured deployment silently accepted forged webhooks, and a correctly-signed one looked like a bad signature. The middleware now throws InvalidOperationException naming the missing setting.

  If you relied on running without a secret, set WebhookOptions.Secret to the value shown in the webhook's settings in Kontent.ai. There is no configuration in which the previous behaviour was safe.

Fixed

• Webhook signature validation honors client disconnection. Reading the request body now observes HttpContext.RequestAborted, so an aborted request stops the read instead of buffering the whole body first.
• <img-asset> reads width and height invariantly, and no longer throws on values that are not numbers. The attributes were parsed with Convert.ToDouble in the server's culture while ImageUrlBuilder writes the value back invariantly, so the round trip disagreed wherever . groups digits — on a de-DE server width="1.5" produced ?w=15, a silent tenfold resize. The same call threw FormatException for any value HTML allows but the image API has no equivalent for (100%, auto, a CSS calc), taking the render down with a 500. Such values now leave the transformation alone; the attribute still renders on the element, so it keeps working as plain HTML.

Dependencies

Shipped floors moved up:

• Kontent.Ai.Delivery, Kontent.Ai.Delivery.Abstractions and Kontent.Ai.Urls 19.4.0 → 20.0.0-rc.1. The 19.x line targets net8.0, so leaving the floor there would let a net10.0 package resolve a .NET 8 build of the SDK it is built on. Staying on Delivery 19.x means staying on Kontent.Ai.AspNetCore 0.17.x.

This package has no direct Microsoft.Extensions.* references — it declares <FrameworkReference Include="Microsoft.AspNetCore.App" />, so those assemblies come from the ASP.NET Core shared framework rather than from a package.

Installation

dotnet add package Kontent.Ai.AspNetCore --prerelease

Full changelog: src/aspnetcore/CHANGELOG.md