Skip to content

Upgrading System.IdentityModel.Tokens.Jwt 4 to 5

Breaking4.0.4.403061554 → 5.7.2Breaking1Security3New22Changed10Fixed9Other9

Full comparisonBack to System.IdentityModel.Tokens.Jwt
BreakingUpgrade verdict

1 breaking change and 3 security fixes.

In plain terms
  • Code that relied on the library exposing Newtonsoft JObject types will no longer compile or work.
  • This update fixes security problems in the library. See the linked advisories for details.
  • Microsoft ASP.NET Core project templates vulnerable to denial of service
  • XML parsing now explicitly blocks DTD processing, reducing XML attack risk.
Must act 4 items need code or config changes

Requires Target frameworks .NETFramework4.5, .NETFramework4.5.1, .NETFramework4.6.1, .NETStandard1.4, .NETStandard2.0 from 5.3.0 (none stated before).

What you must change

Breaking1
Removes any public references to JObject from Microsoft.IdentityModel.JsonWebTokens to distance the library from external dependencies.
JObjectMicrosoft.IdentityModel.JsonWebTokens
5.3.0GitHub ReleaseSummarizedView source
Security3
Fixes security issues detailed in the January 2024 IdentityModel advisories.
5.7.0GitHub ReleaseSummarizedView source
Microsoft ASP.NET Core project templates vulnerable to denial of service
Moderate · CVSS 6.8
5.7.0GitHub AdvisoryOriginalView source
DtdProcessing.Prohibit is now explicitly set when creating an XmlReader.
DtdProcessing.ProhibitXmlReader
5.6.0GitHub ReleaseSummarizedView source