Skip to content

Upgrading System.IdentityModel.Tokens.Jwt 5 to 6

Breaking5.7.2 → 6.36.0Breaking4Security7Deprecated2New47Changed49Fixed52Other21

Full comparisonBack to System.IdentityModel.Tokens.Jwt
BreakingUpgrade verdict

4 breaking changes and 7 security fixes.

In plain terms
  • Removes the OpenIdConnectMessage(JObject json) constructor, replaced by OpenIdConnectMessage(object json).
  • Removes the JsonWebKeySet(string json, JsonSerializerSettings jsonSerializerSettings) constructor.
  • If you use a symmetric key that is too short for HMAC, the library now throws an error instead of accepting it.
  • Moves TokenValidationResult from Microsoft.IdentityModel.JsonWebTokens to Microsoft.IdentityModel.Tokens.
Must act Top 5 of 13 that need code or config changes

Target frameworks requirement changed in 6.29.0: .NETFramework4.5, .NETFramework4.5.1, .NETFramework4.6.1, .NETStandard1.4, .NETStandard2.0 → .NETFramework4.5, .NETFramework4.6.1, .NETFramework4.6.2, .NETFramework4.7.2, .NETStandard2.0, net6.0.

What you must change

Breaking4
Removes the OpenIdConnectMessage(JObject json) constructor, replaced by OpenIdConnectMessage(object json).
OpenIdConnectMessage
6.5.0GitHub ReleaseSummarizedView source
Removes the JsonWebKeySet(string json, JsonSerializerSettings jsonSerializerSettings) constructor.
JsonWebKeySet
6.5.0GitHub ReleaseSummarizedView source
Enforces key sizes when creating HMAC, throwing ArgumentOutOfRangeException if the SymmetricKey is too small.
SymmetricKeyArgumentOutOfRangeException
6.30.1GitHub ReleaseSummarizedView source
Moves TokenValidationResult from Microsoft.IdentityModel.JsonWebTokens to Microsoft.IdentityModel.Tokens.
TokenValidationResult
6.5.0GitHub ReleaseSummarizedView source
Security7
Updates packages to address CVE-2024-30105.
6.36.0GitHub ReleaseSummarizedView source
Fixes security issues detailed in the January 2024 IdentityModel advisories.
6.34.0GitHub ReleaseSummarizedView source
Microsoft ASP.NET Core project templates vulnerable to denial of service
Moderate · CVSS 6.8
6.34.0GitHub AdvisoryOriginalView source
Sets a maximum depth for Newtonsoft JSON parsing to limit deeply nested payloads.
6.27.0GitHub ReleaseSummarizedView source
Validates the size of symmetric signatures.
6.27.0GitHub ReleaseSummarizedView source
The signature of the token is no longer logged.
6.20.0GitHub ReleaseSummarizedView source
Addresses security bugs (#1656, #1661, #1657).
6.12.0GitHub ReleaseSummarizedView source

Deprecations to plan for

Deprecated2
Marks SecurityTokenUnableToValidateException as obsolete since the library stopped throwing it in 6.28.0; it will be removed in a future major version.
SecurityTokenUnableToValidateException
6.30.0GitHub ReleaseSummarizedView source
Marks an exception that is no longer used as obsolete.
6.30.0GitHub ReleaseSummarizedView source