8.0.0-preview.3

This release introduces the following changes:

• OpenIddict now supports dynamic resources stored in the database via the new IOpenIddictResourceManager<TResource>/IOpenIddictResourceStore<TResource> services. See #2450 for more information.

• Initial support for sessions has been added in 8.0 preview 3. Sessions can be used to bind authorizations and tokens to a specific user login (typically stored as a stable, per-authentication claim in the authentication cookie) and will be leveraged in a future preview to implement native backchannel logout.

Note

These changes will require applying a schema update to add the new Resource and Session entities.

• The Entity Framework Core, Entity Framework 6 and MongoDB stores and models have been deeply modernized by changing the type of some properties and removing a lot of workarounds that are no longer necessary with modern versions of EF Core. For more information, see:
  • Modernize the Entity Framework Core models and stores.
  • Modernize the MongoDB models and stores.

Note

As part of this change, the EF Core stores now use JSON operators in some of their methods: when testing OpenIddict 8.0 preview 3, make sure your database supports JSON queries.

• OpenIddict now always flows the CancellationToken exposed by the ASP.NET Core and OWIN hosts but defers the signal to ensure a malicious actor cannot stop event handlers from being invoked by sending TCP RST packets immediately before sensitive operations are started. See #2516 for more information.

Tip

All the built-in event handlers have been updated to use context.CancellationToken. Developers writing custom event handlers are encouraged to also honor it when moving to OpenIddict 8.0 preview 3.

• OpenIddict now exposes the IServiceProvider instance provided by the host via its events model. As part of this change, all the built-in scoped event handlers have been converted to singleton services to eliminate most of the per-request allocations caused by OpenIddict. Benchmarks show a significant reduction of 10% of the total allocations during a grant_type=password token request.

• A regression introduced in the last preview that was affecting how user codes were generated was identified and fixed.

• The GitHub web provider was fixed to support the iss parameter now returned by GitHub. As part of this change, the issuer was also changed to https://github.com/login/oauth, which is the value now officially used by GitHub.

• The ReplaceDefault*Entity() methods exposed by OpenIddictMongoDbBuilder now register the stores as singleton services instead of scoped services.

• The client system integration was updated to always attach an IASWebAuthenticationPresentationContextProviding object to the ASWebAuthenticationSession on Mac Catalyst and macOS, matching the logic already used on iOS (thanks @amirburbea for reporting this issue! ❤️).