Release 1.8.0

[kailash-b]

Added

• Multi-Resource Refresh Token (MRRT) support #249, #251 (kailash-b) - applications can now obtain access tokens for additional audiences and scopes on demand by exchanging the session's refresh token, without forcing the user through another interactive login.
  • New HttpContext.GetAccessTokenAsync(AccessTokenRequest) extension returns an access token for a requested audience and/or scope, served from the session cache when possible and otherwise via a refresh-token exchange.
  • Configure default scopes per audience with Auth0WebAppWithAccessTokenOptions.ScopeByAudience.
  • The new OnAccessTokenRefreshFailed event surfaces refresh failures, letting callers distinguish terminal failures (warranting re-login) from transient ones.
  • MFA challenge handling - when a refresh requires MFA, a new MfaRequiredException surfaces the challenge, and IAuthenticationApiClient (registered via WithAuthenticationApiClient()) lets the application complete OTP, OOB, or recovery-code grants and manage authenticators.
• Configurable access-token expiration leeway #247 (kailash-b) - new Auth0WebAppWithAccessTokenOptions.AccessTokenExpirationLeeway (TimeSpan, default 60s) controls how far ahead of expiry the SDK proactively refreshes the access token. Previously hard-coded to 60 seconds; the default preserves prior behavior. Applies to both primary and additional (MRRT) cached tokens, and only takes effect when UseRefreshTokens is enabled.
• Configurable server-side session store #246 (kailash-b) - new WithSessionStore method on Auth0WebAppAuthenticationBuilder stores the authentication session server-side (via ITicketStore) instead of in the cookie. It attaches the store to the SDK's own resolved cookie scheme, so it works even with a custom CookieAuthenticationScheme. Two overloads are provided: WithSessionStore<TStore>() (resolved from DI) and WithSessionStore(ITicketStore instance). Opt-in and additive; the default stateless cookie session is unchanged.

Fixed

• Remove duplicate trailing slash from client_assertion audience #236 (samjetski) - fixes a regression introduced in 1.7.0 (Adds support for multiple custom domains #206) where the Private Key JWT client assertion aud claim was built as https://{tenant}// (double slash), causing Auth0's /oauth/token endpoint to reject the assertion with 401 invalid_client and leaving affected apps (any using ClientAssertionSecurityKey) in a callback loop.
• Wire OnValidatePrincipal to the configured cookie scheme #248 (kailash-b) - fixes a scheme mismatch where the access-token refresh hook was registered against the default "Cookies" scheme rather than the configured CookieAuthenticationScheme.

Security

• Bump dependencies #250 (kailash-b) - consolidates several Dependabot bumps (supersedes chore(deps): Bump Microsoft.IdentityModel.Protocols.OpenIdConnect from 8.18.0 to 8.19.1 #240, chore(deps): Bump Microsoft.AspNetCore.Mvc.Testing from 10.0.8 to 10.0.9 #242, chore(deps): Bump Microsoft.AspNetCore.Mvc.ViewFeatures from 2.3.10 to 2.3.11 #243, chore(deps): Bump System.Text.Encodings.Web from 10.0.8 to 10.0.9 #244): Microsoft.IdentityModel.Protocols.OpenIdConnect 8.18.0 → 8.19.1, Microsoft.AspNetCore.Mvc.Testing 10.0.8 → 10.0.9, Microsoft.AspNetCore.Mvc.ViewFeatures 2.3.10 → 2.3.11, System.Text.Encodings.Web 10.0.8 → 10.0.9.
• Pin GitHub Actions to commit SHAs #241 (jcchavezs) - pins all third-party actions in the workflow files to commit SHAs for improved supply-chain security and reproducibility.