Upgrading System.IdentityModel.Tokens.Jwt 7 to 8
Breaking7.7.3 → 8.23.0Breaking16Security9Deprecated1New51Changed58Fixed56Other160
BreakingUpgrade verdict
15 breaking changes and 9 security fixes.
In plain terms
- A property that was never used has been removed from the claims identity used by JsonWebToken.
- Some public methods that were accidentally added and could not be used are gone, so code referencing them will no longer compile.
- Renames validation delegates.
- Removes TransformBeforeSignatureValidationDelegate from ValidationParameters.
Must act Top 5 of 25 that need code or config changes
Target frameworks requirement changed in 8.15.0: .NETFramework4.6.1, .NETFramework4.6.2, .NETFramework4.7.2, .NETStandard2.0, net6.0, net8.0 → .NETFramework4.6.2, .NETFramework4.7.2, .NETStandard2.0, net10.0, net6.0, net8.0, net9.0.
What you must change
Breaking15
Removes an unused property on the JsonWebToken ClaimsIdentity.
JsonWebTokenClaimsIdentityRemoves multiple unused and unusable public APIs that were introduced by mistake from logging and exception handling work.
Renames validation delegates.
Removes TransformBeforeSignatureValidationDelegate from ValidationParameters.
TransformBeforeSignatureValidationDelegateValidationParametersRemoves Obsolete BinaryFormatter.
BinaryFormatterRenames ResolveTokenDecryptionKeyDelegate to DecryptionKeyResolverDelegate.
ResolveTokenDecryptionKeyDelegateDecryptionKeyResolverDelegateRemoves delegate checks in multiple validators and prevents setting delegates to null.
Removes delegate checks in the audience validator and prevents setting the delegate to null.
Removes the Microsoft.IdentityModel.KeyVaultExtensions and Microsoft.IdentityModel.ManagedKeyVaultSecurityKey packages, which relied on ADAL.
Microsoft.IdentityModel.KeyVaultExtensionsMicrosoft.IdentityModel.ManagedKeyVaultSecurityKeyRemoves the AppContext.SetSwitch switches from IdentityModel 7x and makes their behavior the default in 8x.
AppContext.SetSwitchReverts the Configuration Manager to version 8.3.1, undoing the 8.4.0 IDisposable change that was a breaking change.
IDisposableReverts the configuration manager to 8.3.1.
CertificateHelper.LoadX509Certificate() now takes a string instead of byte[] to reduce calls to Convert.FromBase64String.
CertificateHelper.LoadX509Certificate()Convert.FromBase64StringAdds CaseSensitiveClaimsIdentity for case-sensitive claim retrieval consistent with SecurityToken, with AppContext fallback to old behavior.
ClaimsIdentityCaseSensitiveClaimsIdentitySecurityTokenMakes CollectionUtilities.IsNullOrEmpty internal, requiring callers to supply their own implementation.
CollectionUtilities.IsNullOrEmptySecurity9
Disables automatic redirects on the default HttpClient used for JKU retrieval.
HttpClientImproves validation of the
jku claim.jkuFails closed when replay protection is not configured and adds other DPoP hardening.
DPoPApplies RFC 3986 section 6.2.2 normalization to DPoP
htu comparison.htuDPoPSanitizes logs to avoid leaking sensitive data such as secrets or PII.
Updates System.Text.Json to 8.0.5 to address CVE-2024-43485.
System.Text.JsonMoves to public NuGet and addresses CVEs.
Adds BannedApiAnalyzers to prevent use of ClaimsIdentity constructors.
BannedApiAnalyzersClaimsIdentityUpdates packages to address CVE-2024-30105.
Deprecations to plan for
Deprecated1
Notes that Microsoft.Rest.ClientRuntime has been deprecated.
Microsoft.Rest.ClientRuntime