What's new in ASP.NET Core in .NET 11 Preview 7

aspnetcore/release-notes/aspnetcore-11.md

@@ -4,7 +4,7 @@ ai-usage: ai-assisted
 author: wadepickett
 description: Learn about the new features in ASP.NET Core in .NET 11.
 ms.author: wpickett
-ms.date: 07/21/2026
+ms.date: 08/12/2026
 uid: aspnetcore-11
 ---
 # What's new in ASP.NET Core in .NET 11
@@ -33,6 +33,8 @@ This section describes new features for SignalR.
 
 [!INCLUDE[](~/release-notes/aspnetcore-11/includes/signalr-cancel-hub-invocations-preview-6.md)]
 
+[!INCLUDE[](~/release-notes/aspnetcore-11/includes/signalr-auth-refresh-redirects-preview-7.md)]
+
 ## Minimal APIs
 
 This section describes new features for Minimal APIs.
@@ -45,6 +47,10 @@ This section describes new features for Minimal APIs.
 
 [!INCLUDE[](~/release-notes/aspnetcore-11/includes/short-circuit-endpoints-attribute-preview-6.md)]
 
+[!INCLUDE[](~/release-notes/aspnetcore-11/includes/validation-localization-preview-7.md)]
+
+[!INCLUDE[](~/release-notes/aspnetcore-11/includes/validation-attributes-no-longer-experimental-preview-7.md)]
+
 ## OpenAPI
 
 This section describes new features for OpenAPI.
@@ -61,6 +67,8 @@ This section describes new features for OpenAPI.
 
 [!INCLUDE[](~/release-notes/aspnetcore-11/includes/openapi-3-2-default-preview-6.md)]
 
+[!INCLUDE[](~/release-notes/aspnetcore-11/includes/openapi-server-sent-events-preview-7.md)]
+
 ## Authentication and authorization
 
 This section describes new features for authentication and authorization.
@@ -71,6 +79,8 @@ This section describes new features for authentication and authorization.
 
 [!INCLUDE[](~/release-notes/aspnetcore-11/includes/user-jwts-file-based-apps-preview-6.md)]
 
+[!INCLUDE[](~/release-notes/aspnetcore-11/includes/consistent-authorization-metadata-preview-7.md)]
+
 ## Miscellaneous
 
 This section describes miscellaneous new features in .NET 11.
@@ -99,6 +109,8 @@ This section describes miscellaneous new features in .NET 11.
 
 [!INCLUDE[](~/release-notes/aspnetcore-11/includes/kestrel-trailer-header-timeouts-preview-5.md)]
 
+[!INCLUDE[](~/release-notes/aspnetcore-11/includes/tls-channel-binding-token-preview-7.md)]
+
 ## Breaking changes
 
 Use the articles in [Breaking changes in .NET](/dotnet/core/compatibility/breaking-changes) to find breaking changes that might apply when upgrading an app to a newer version of .NET.

aspnetcore/release-notes/aspnetcore-11/includes/consistent-authorization-metadata-preview-7.md

@@ -0,0 +1,18 @@
+### Consistent authorization metadata across the stack
+
+Authorization metadata can be expressed as <xref:Microsoft.AspNetCore.Authorization.IAuthorizeData>, an <xref:Microsoft.AspNetCore.Authorization.AuthorizationPolicy>, or an <xref:Microsoft.AspNetCore.Authorization.IAuthorizationRequirementData> attribute. MVC filters, SignalR hub methods, and Blazor's `AuthorizeView` and `AuthorizeRouteView` apply all three forms consistently.
+
+<!-- TODO: Update `AuthorizationPolicy.CombineAsync` to <xref:> once the new overload's API docs are published. -->
+
+A new `AuthorizationPolicy.CombineAsync` overload is the shared implementation:
+
+```csharp
+public class AuthorizationPolicy
+{
+    public static Task<AuthorizationPolicy?> CombineAsync(
+        IAuthorizationPolicyProvider policyProvider,
+        IEnumerable<object> metadata);
+}
+```
+
+MVC, SignalR, and Blazor use this overload internally. A custom attribute that implements both <xref:Microsoft.AspNetCore.Authorization.IAuthorizeData> and <xref:Microsoft.AspNetCore.Authorization.IAuthorizationRequirementData> contributes to the decision once. The legacy MVC path with `EnableEndpointRouting = false` is unchanged.

aspnetcore/release-notes/aspnetcore-11/includes/openapi-server-sent-events-preview-7.md

@@ -0,0 +1,41 @@
+### Server-Sent Events support in OpenAPI 3.2
+
+Endpoints that return `SseItem<T>` are described in the generated OpenAPI document with the OpenAPI 3.2 `itemSchema` shape for `text/event-stream` responses. The `itemSchema` describes a stream's per-event payload shape instead of falling back to a plain `string` schema.
+
+```csharp
+app.MapGet("/todos/stream", (CancellationToken ct) =>
+    TypedResults.ServerSentEvents(GetTodosAsync(ct)))
+   .WithName("StreamTodos");
+
+static async IAsyncEnumerable<SseItem<Todo>> GetTodosAsync(
+    [EnumeratorCancellation] CancellationToken ct = default)
+{
+    foreach (var todo in Todos.All)
+    {
+        yield return new SseItem<Todo>(todo) { EventId = todo.Id.ToString() };
+        await Task.Delay(1000, ct);
+    }
+}
+```
+
+Return the stream through `TypedResults.ServerSentEvents`. A handler that returns `IAsyncEnumerable<SseItem<T>>` directly is serialized as JSON instead of SSE. Use the dedicated `SseItem<T>` overload without `eventType`. To use one event name for the whole stream, pass a plain `IAsyncEnumerable<T>` with `eventType`.
+
+The generated 3.2 document describes the event payload with `itemSchema` referencing `#/components/schemas/Todo`, plus the standard SSE `event` and `id` string fields:
+
+```yaml
+responses:
+  '200':
+    description: OK
+    content:
+      text/event-stream:
+        itemSchema:
+          type: object
+          required: [data]
+          properties:
+            data:
+              $ref: '#/components/schemas/Todo'
+            event: { type: string }
+            id: { type: string }
+```
+
+If the event payload is a discriminated union (a preview C# 14 feature), OpenAPI also emits the union's case names as an `enum` on the `event` field.

aspnetcore/release-notes/aspnetcore-11/includes/signalr-auth-refresh-redirects-preview-7.md

@@ -0,0 +1,7 @@
+### SignalR .NET client supports authentication refresh after redirects
+
+The SignalR .NET client extends [SignalR authentication refresh](#signalr-authentication-refresh) so it works when negotiate redirects to another server, contributed by [@MoChilia](https://github.com/MoChilia). This client change enables support for redirecting servers such as Azure SignalR Service, but Azure SignalR Service hasn't enabled the feature yet.
+
+The client preserves the app-token provider across the redirect, adopts a refreshed transport token from the response, and retains `tokenLifetimeSeconds` so automatic refresh remains scheduled after the original token expires.
+
+Thank you [@MoChilia](https://github.com/MoChilia) for this contribution!

aspnetcore/release-notes/aspnetcore-11/includes/tls-channel-binding-token-preview-7.md

@@ -0,0 +1,26 @@
+### TLS channel-binding token access from `ITlsConnectionFeature`
+
+Applications using TLS can read the connection's channel binding token to defend against relay attacks:
+
+```csharp
+using System.Security.Authentication.ExtendedProtection;
+
+app.Use(async (context, next) =>
+{
+    var tls = context.Features.Get<ITlsConnectionFeature>();
+    if (tls is not null && tls.TryGetChannelBindingBytes(
+            ChannelBindingKind.Endpoint,
+            out ReadOnlyMemory<byte> cbt))
+    {
+        // Compare cbt against the token the client presented during authentication.
+    }
+
+    await next(context);
+});
+```
+
+Kestrel returns the binding from `SslStream.TransportContext.GetChannelBinding`. IIS and HTTP.sys return it from the request. On HTTP.sys, `HttpSysOptions.HttpAuthenticationHardeningLevel` controls Extended Protection and channel-binding token exposure:
+
+* `Legacy` disables channel-binding validation and doesn't expose the token.
+* `Medium`, the default, exposes the token and validates it when supplied, but tolerates its absence.
+* `Strict` requires the token for authenticated requests and rejects requests without one. It also fails startup if the OS can't apply the configuration, while `Legacy` and `Medium` log the configuration failure and continue.

aspnetcore/release-notes/aspnetcore-11/includes/validation-attributes-no-longer-experimental-preview-7.md

@@ -0,0 +1,3 @@
+### Validation attributes are no longer experimental
+
+`ValidatableTypeAttribute` and `SkipValidationAttribute` are no longer marked experimental. If you suppressed `ASP0029` to use either attribute, remove the suppression.

aspnetcore/release-notes/aspnetcore-11/includes/validation-localization-preview-7.md

@@ -0,0 +1,43 @@
+### Validation localization is built in
+
+`Microsoft.Extensions.Validation` localizes validation messages and display names without a separate package. Calling `AddLocalization` to register an `IStringLocalizerFactory`, followed by `AddValidation`, activates localization automatically, and the lookup is emitted by the validation source generator into your assembly.
+
+<!-- TODO: Update `AddValidation`, `ValidationOptions.LocalizerProvider`, and `IValidationMessageFormatter` to <xref:> once API docs are published. -->
+
+```csharp
+builder.Services.AddLocalization();
+builder.Services.AddValidation();
+```
+
+```csharp
+[ValidatableType]
+public class CustomerModel
+{
+    [Display(Name = "CustomerName")]          // resource key for the display name
+    [Required(ErrorMessage = "NameRequired")] // resource key for the message
+    public string? Name { get; set; }
+}
+```
+
+Keys resolve against the model's own resources, and a miss falls back to the attribute's built-in message. Use `ValidationOptions.LocalizerProvider` to resolve keys from a shared resource file instead:
+
+```csharp
+builder.Services.AddValidation(options =>
+{
+    options.LocalizerProvider = (_, factory) => factory.Create(typeof(ValidationMessages));
+});
+```
+
+Attributes that already localize themselves (`ErrorMessageResourceType`, `[Display(ResourceType = …)]`) bypass the pipeline entirely. A custom attribute that needs to substitute its own values into the message template can implement `IValidationMessageFormatter`:
+
+```csharp
+public sealed class DivisibleByAttribute : ValidationAttribute, IValidationMessageFormatter
+{
+    public int Divisor { get; init; }
+
+    public string FormatMessage(CultureInfo culture, string template, string displayName)
+        => string.Format(culture, template, displayName, Divisor); // {0} = name, {1} = divisor
+}
+```
+
+The same localization rules apply to validation for minimal APIs and Blazor, so a message localizes identically wherever the model is used.