Upgrading System.IdentityModel.Tokens.Jwt 6 to 7
Breaking6.36.0 → 7.7.3Breaking1Security4Platform1Deprecated1New9Changed23Fixed25Other34
BreakingUpgrade verdict
1 breaking change and a platform requirement change and 4 security fixes.
In plain terms
- Code that awaits the issuer validator still works, but code that stores or passes around the returned Task must be updated.
- Projects still on .NET Framework 4.5 can no longer use this package and must move to a newer framework.
- This release includes a fix for a known security vulnerability.
- Tokens that have extra characters appended to them are now rejected instead of being accepted as valid.
Must act Top 5 of 7 that need code or config changes
Target frameworks requirement changed in 7.6.1: .NETFramework4.5, .NETFramework4.6.1, .NETFramework4.6.2, .NETFramework4.7.2, .NETStandard2.0, net6.0 → .NETFramework4.6.1, .NETFramework4.6.2, .NETFramework4.7.2, .NETStandard2.0, net6.0, net8.0.
What you must change
Breaking1
Changes AadIssuerValidator to return ValueTask<string> instead of Task<string>.
AadIssuerValidatorValueTask<string>Task<string>Security4
Updates packages for CVE-2024-30105.
Validates authentication tag length so a JWE with appended characters is no longer considered a valid token.
Fixes security issues detailed in the January 2024 IdentityModel advisories.
Microsoft ASP.NET Core project templates vulnerable to denial of service
Moderate · CVSS 6.8Platform1
Removes the net45 target framework.
Deprecations to plan for
Deprecated1
Deprecates int? JwtPayload.Exp, .Iat, and .Nbf.
JwtPayload.ExpJwtPayload.IatJwtPayload.Nbf