Skip to content

3.2.0

Choose a tag to compare

View all tags
@madeyoga madeyoga released this 08 Oct 07:48
v3.2.0
a79099e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

AuthEndpoints

A signed-in user without a matching step-up proof gets 403 on passkey mutations, POST /manage/2fa, POST /manage/info, and external login unlink. The step-up credential is never a sign-in and never replaces HttpContext.User. ReAuthPolicy adds no authentication schemes. The requirement succeeds only when the route's sign-in user matches a ReAuth proof with Reauth=true, the same user id, and the user's current security stamp.

.RequireReauth() must be paired with a sign-in authorization. It does not authenticate the application cookie, Identity bearer, or JWT. A route that omits that authorization fails. A request that presents only a step-up cookie or header is rejected.

CSRF is skipped only when a non-empty Authorization: Bearer header is present, Identity bearer or JWT authenticates, and the application cookie does not. Hosts that read the access token from a cookie still send the CSRF token. The filter does not call OnMessageReceived.

POST /confirmIdentity returns reauthToken. Cookie sign-ins also receive the ReAuth cookie. A caller authenticated with Authorization: Bearer receives the token only and sends it on the sensitive call.

Passkeys: deleting the last passkey on an account with no password and no external login is refused (LastSignInMethod), and rename trims the name and rejects names longer than 200 characters.

Upgrading from 3.1.x

  • A signed-in caller without a matching step-up proof now gets 403 on passkey mutations, POST /manage/2fa, POST /manage/info, and external login unlink.
  • .RequireReauth() must be paired with RequireAuthorization() that signs the user in. The step-up credential is never a sign-in and never replaces HttpContext.User. Without that sign-in authorization, the request fails.
  • Callers authenticated with Authorization: Bearer no longer receive the ReAuth cookie. They keep reauthToken and send X-AuthEndpoints-Reauth. Cookie sign-ins still receive both.
  • CSRF is skipped only when the request has a non-empty Authorization: Bearer header and Identity bearer or JWT authenticates. A token that arrives only in a cookie still needs the CSRF token.
  • Step-up proofs are bound to the user's security stamp. A password change, reset, or UpdateSecurityStampAsync cancels an outstanding ReAuth cookie or X-AuthEndpoints-Reauth token. A proof with no stamp is rejected.

AuthEndpoints.External.OAuth

ExternalReauthFilter is gone. Unlink uses .RequireReauth() together with the management authorize attribute (application cookie, Identity bearer, and JWT). This package needs AuthEndpoints 3.2.0.

Packages

  • AuthEndpoints 3.2.0
  • AuthEndpoints.External.OAuth 3.0.0-preview.5
  • AuthEndpoints.OAuth.GitHub and AuthEndpoints.OAuth.Google unchanged at 3.0.0-preview.4

Links

Assets 2
Loading