Bump Microsoft.OpenApi from 2.0.0 to 3.8.0#51
Closed
dependabot[bot] wants to merge 43 commits into
Closed
Conversation
The previous implementation had two issues in HandleRefreshTokenGrantAsync: 1. A duplicate revocation hotfix block re-fetched and revoked the token BEFORE the rotation logic, causing Rotate() to operate on an already revoked token. This left the token in an inconsistent state. 2. The old token was revoked before the new token was created. If the CreateAsync call for the new token failed (DB error, timeout), the user would be left without any valid refresh token. Fix: Create the new refresh token first, then revoke the old one. This ensures the user always has at least one valid refresh token even if the rotation process fails partway through. Removed the redundant hotfix block that was conflicting with the rotation logic.
Fix refresh token rotation to prevent token family corruption
- Add GitHub Actions build and test workflow - Add bug report and feature request issue templates - Add pull request template - Add GitHub Sponsors funding configuration - Improve .gitignore for better development experience
Add CI/CD pipeline and project configuration
Include a unique JWT ID (jti) claim in both user and client credentials access tokens. This enables token revocation by blacklisting specific token IDs, and is a prerequisite for token introspection (RFC 7662). Each token now gets a Guid-based jti, making individual tokens identifiable in audit logs and revocation lists. Ref #30
Add jti claim to access tokens
The Client entity already exposes AccessTokenLifetime and RefreshTokenLifetime fields but TokenService was ignoring them, always falling back to the global AuthServerOptions defaults. Changes: - Add GetAccessTokenLifetime(Client?) / GetRefreshTokenLifetime(Client?) helpers that return the client-specific value when set (> 0) and the global default otherwise. - Look up the client record inside HandleAuthorizationCodeGrantAsync and HandlePasswordGrantAsync so the per-client lifetime can be applied. - HandleRefreshTokenGrantAsync now also looks up the client on rotation. - HandleClientCredentialsGrantAsync already has the Client object; updated to use the new helpers. - GenerateAccessToken and GenerateAndStoreRefreshTokenAsync now accept an explicit lifetimeSeconds parameter instead of reading _options directly. - ExpiresIn in every TokenResponse now reflects the actual lifetime used. Mobile apps (Flutter) can be configured with longer refresh token lifetimes (e.g. 30+ days) while browser SPAs keep shorter defaults, all without touching global configuration. closes #27
Access tokens already carry a jti (JWT ID) claim. This change wires up the revocation infrastructure that makes that claim useful: - src/Security/RevokedTokenStore.cs: singleton in-memory store that maps jti values to their original expiry. Entries are self-expiring and purged hourly by TokenCleanupWorker. - TokenRevocationHandler: after failing to match a refresh-token hash, now attempts to parse the value as a signed JWT, extracts the jti and exp, and adds the entry to RevokedTokenStore. Access tokens issued by this server can therefore be individually revoked without affecting other tokens. - TokenIntrospectionHandler: checks RevokedTokenStore before returning active=true, so revoked access tokens are correctly reported as inactive. - TokenCleanupWorker: calls RevokedTokenStore.PurgeExpired() each cycle to bound memory usage. - Program.cs: registers RevokedTokenStore as a singleton. closes #30
Brute-force and credential-stuffing attacks on the password grant endpoint are mitigated by a new sliding-window rate limiter. - src/Security/LoginRateLimiter.cs: tracks failed attempts per username and per IP address in a ConcurrentDictionary. After FailedLoginAttemptThreshold failures within an AccountLockoutDurationMinutes window the caller receives an AuthServerException(429) with a Retry-After-compatible message. Successful logins clear the username counter. Entries outside the window are pruned on each write to bound memory. - TokenService.HandlePasswordGrantAsync: calls ThrowIfBlocked before touching the user store (prevents timing oracle), records RecordFailure on bad credentials, and RecordSuccess on authenticated login. - TokenRequest: new IpAddress property populated by TokenController from HttpContext.Connection.RemoteIpAddress so the service layer can enforce per-IP limits without depending on IHttpContextAccessor. - Program.cs: registers LoginRateLimiter as a singleton. Configurable via existing AuthServerOptions: FailedLoginAttemptThreshold (default 5) AccountLockoutDurationMinutes (default 15) closes #34
--- updated-dependencies: - dependency-name: Microsoft.OpenApi dependency-version: 3.8.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated Microsoft.OpenApi from 2.0.0 to 3.8.0.
Release notes
Sourced from Microsoft.OpenApi's releases.
3.8.0
3.8.0 (2026-07-03)
Features
Bug Fixes
3.7.0
3.7.0 (2026-06-10)
Features
Bug Fixes
3.6.0
3.6.0 (2026-06-01)
Features
3.5.5
3.5.5 (2026-05-28)
Bug Fixes
3.5.4
3.5.4 (2026-05-26)
Bug Fixes
3.5.3
3.5.3 (2026-04-27)
Bug Fixes
Performance Improvements
3.5.2
3.5.2 (2026-04-14)
Bug Fixes
3.5.1
3.5.1 (2026-03-31)
Bug Fixes
3.5.0
3.5.0 (2026-03-20)
Features
Bug Fixes
3.4.0
3.4.0 (2026-03-04)
Features
Bug Fixes
3.3.1
3.3.1 (2026-01-22)
Features
Bug Fixes
3.3.0
3.3.0 (2026-01-21)
Features
3.2.0
3.2.0 (2026-01-19)
Features
Bug Fixes
3.1.3
3.1.3 (2026-01-16)
Bug Fixes
3.1.2
3.1.2 (2026-01-06)
Bug Fixes
3.1.1
3.1.1 (2025-12-18)
Bug Fixes
additionalProperties: false(6651c36)additionalProperties: false(e36fc95)3.1.0
3.1.0 (2025-12-17)
Features
type: "null"downcasting when in oneOf and anyOf for OpenAPI v3 (782cf8d)3.0.3
3.0.3 (2025-12-16)
Bug Fixes
3.0.2
3.0.2 (2025-12-08)
Bug Fixes
3.0.1
3.0.1 (2025-11-17)
Bug Fixes
3.0.0
3.0.0 (2025-11-11)
⚠ BREAKING CHANGES
Features
Special thanks
2.10.0
2.10.0 (2026-07-03)
Features
Bug Fixes
2.9.0
2.9.0 (2026-06-10)
Features
Bug Fixes
2.8.0
2.8.0 (2026-06-01)
Features
2.7.6
2.7.6 (2026-05-28)
Bug Fixes
2.7.5
2.7.5 (2026-05-26)
Bug Fixes
2.7.4
2.7.4 (2026-04-27)
Bug Fixes
Performance Improvements
2.7.3
2.7.3 (2026-04-14)
Bug Fixes
2.7.2
2.7.2 (2026-03-31)
Bug Fixes
2.7.1
2.7.1 (2026-03-20)
Bug Fixes
2.7.0
2.7.0 (2026-03-05)
Features
Bug Fixes
2.6.1
2.6.1 (2026-01-22)
Bug Fixes
2.6.0
2.6.0 (2026-01-21)
Features
2.5.0
2.5.0 (2026-01-19)
Features
Bug Fixes
2.4.3
2.4.3 (2026-01-16)
Bug Fixes
2.4.2
2.4.2 (2025-12-22)
Bug Fixes
2.4.1
2.4.1 (2025-12-18)
Bug Fixes
additionalProperties: false(6651c36)additionalProperties: false(e36fc95)2.4.0
2.4.0 (2025-12-17)
Features
type: "null"downcasting when in oneOf and anyOf for OpenAPI v3 (782cf8d)2.3.12
2.3.12 (2025-12-15)
Bug Fixes
2.3.11
2.3.11 (2025-12-08)
Bug Fixes
2.3.10
2.3.10 (2025-11-17)
Bug Fixes
2.3.9
2.3.9 (2025-11-06)
Bug Fixes
2.3.8
2.3.8 (2025-10-27)
Bug Fixes
2.3.7
2.3.7 (2025-10-24)
Bug Fixes
Performance Improvements
2.3.6
2.3.6 (2025-10-20)
Bug Fixes
2.3.5
2.3.5 (2025-10-14)
Bug Fixes
2.3.4
2.3.4 (2025-10-06)
Bug Fixes
2.3.3
2.3.3 (2025-10-02)
Bug Fixes
2.3.2
2.3.2 (2025-09-19)
Bug Fixes
2.3.1
2.3.1 (2025-09-08)
Bug Fixes
2.3.0
2.3.0 (2025-08-29)
Features
2.2.0
2.2.0 (2025-08-25)
Features
Bug Fixes
2.1.0
2.1.0 (2025-08-20)
Features
Bug Fixes
2.0.1
2.0.1 (2025-08-18)
Bug Fixes
Commits viewable in compare view.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)