Bump Auth0.AspNetCore.Authentication from 1.7.0 to 1.8.0

[dependabot]

Updated Auth0.AspNetCore.Authentication from 1.7.0 to 1.8.0.

Release notes

Sourced from Auth0.AspNetCore.Authentication's releases.

1.8.0

Added

• Multi-Resource Refresh Token (MRRT) support #​249, #​251 (kailash-b) - applications can now obtain access tokens for additional audiences and scopes on demand by exchanging the session's refresh token, without forcing the user through another interactive login.
  • New HttpContext.GetAccessTokenAsync(AccessTokenRequest) extension returns an access token for a requested audience and/or scope, served from the session cache when possible and otherwise via a refresh-token exchange.
  • Configure default scopes per audience with Auth0WebAppWithAccessTokenOptions.ScopeByAudience.
  • The new OnAccessTokenRefreshFailed event surfaces refresh failures, letting callers distinguish terminal failures (warranting re-login) from transient ones.
  • MFA challenge handling - when a refresh requires MFA, a new MfaRequiredException surfaces the challenge, and IAuthenticationApiClient (registered via WithAuthenticationApiClient()) lets the application complete OTP, OOB, or recovery-code grants and manage authenticators.
• Configurable access-token expiration leeway #​247 (kailash-b) - new Auth0WebAppWithAccessTokenOptions.AccessTokenExpirationLeeway (TimeSpan, default 60s) controls how far ahead of expiry the SDK proactively refreshes the access token. Previously hard-coded to 60 seconds; the default preserves prior behavior. Applies to both primary and additional (MRRT) cached tokens, and only takes effect when UseRefreshTokens is enabled.
• Configurable server-side session store #​246 (kailash-b) - new WithSessionStore method on Auth0WebAppAuthenticationBuilder stores the authentication session server-side (via ITicketStore) instead of in the cookie. It attaches the store to the SDK's own resolved cookie scheme, so it works even with a custom CookieAuthenticationScheme. Two overloads are provided: WithSessionStore<TStore>() (resolved from DI) and WithSessionStore(ITicketStore instance). Opt-in and additive; the default stateless cookie session is unchanged.

Fixed

• Remove duplicate trailing slash from client_assertion audience #​236 (samjetski) - fixes a regression introduced in 1.7.0 (#​206) where the Private Key JWT client assertion aud claim was built as https://{tenant}// (double slash), causing Auth0's /oauth/token endpoint to reject the assertion with 401 invalid_client and leaving affected apps (any using ClientAssertionSecurityKey) in a callback loop.
• Wire OnValidatePrincipal to the configured cookie scheme #​248 (kailash-b) - fixes a scheme mismatch where the access-token refresh hook was registered against the default "Cookies" scheme rather than the configured CookieAuthenticationScheme.

Security

• Bump dependencies #​250 (kailash-b) - consolidates several Dependabot bumps (supersedes #​240, #​242, #​243, #​244): Microsoft.IdentityModel.Protocols.OpenIdConnect 8.18.0 → 8.19.1, Microsoft.AspNetCore.Mvc.Testing 10.0.8 → 10.0.9, Microsoft.AspNetCore.Mvc.ViewFeatures 2.3.10 → 2.3.11, System.Text.Encodings.Web 10.0.8 → 10.0.9.
• Pin GitHub Actions to commit SHAs #​241 (jcchavezs) - pins all third-party actions in the workflow files to commit SHAs for improved supply-chain security and reproducibility.

1.7.1

Security

• chore: Upgrade dependencies #​237 (kailash-b)
• chore(deps): Bump System.Text.Encodings.Web from 10.0.6 to 10.0.7 #​228 (dependabot[bot])
• chore(deps): Bump Microsoft.AspNetCore.Mvc.Testing from 10.0.6 to 10.0.7 #​227 (dependabot[bot])
• chore(deps): Bump Microsoft.NET.Test.Sdk from 18.4.0 to 18.5.1 #​229 (dependabot[bot])
• chore(deps): Bump Microsoft.IdentityModel.Protocols.OpenIdConnect from 8.17.0 to 8.18.0 #​230 (dependabot[bot])
• chore(deps): Bump System.Text.Encodings.Web from 10.0.5 to 10.0.6 #​225 (dependabot[bot])
• chore(deps): Bump Microsoft.AspNetCore.Mvc.Testing from 10.0.5 to 10.0.6 #​224 (dependabot[bot])
• chore(deps): Bump Microsoft.NET.Test.Sdk from 18.3.0 to 18.4.0 #​222 (dependabot[bot])
• chore(deps): Bump Microsoft.IdentityModel.Protocols.OpenIdConnect from 8.16.0 to 8.17.0 #​221 (dependabot[bot])

Commits viewable in compare view.