Changelog

AuthEndpoints

On hosts without o.Jwt.Enabled, CSRF-protected endpoints returned 500 for callers without an application cookie. The CSRF check tried to authenticate against the JWT Bearer scheme, which those hosts never register. Anonymous passkey requestOptions, register/options, register, and login failed on the default cookie facade and the Identity bearer facade. The check now skips unregistered schemes. Requests without a CSRF token return 400, and requests with a valid token succeed.

• Anonymous passkey ceremonies work on the default cookie and Identity bearer facades without JWT
• Missing or invalid CSRF tokens return 400 instead of 500
• Hosts with JWT enabled behave as before

Packages

• AuthEndpoints 3.1.1
• AuthEndpoints.External.OAuth, AuthEndpoints.OAuth.GitHub, and AuthEndpoints.OAuth.Google unchanged at 3.0.0-preview.4

Links

• GitHub release
• Compare
• Installation

AuthEndpoints.External.OAuth

• GitHub and Google handlers moved to their own packages. This nupkg no longer references either handler.
• AutoLinkByEmail defaults to false. When enabled, auto-link requires a verified provider email and a confirmed local email.
• Login and link failures, including remote failure, clear the Identity.External cookie.
• returnUrl accepts rooted local paths and allowlists absolute origins the same way email-confirmation redirects do.
• Unlink requires authorization, antiforgery, and ReAuth, and refuses the last sign-in method.
• JWT completion writes only the refresh cookie.

AuthEndpoints.OAuth.GitHub

• New package. AddGitHub loads a verified address from the GitHub emails API (verified primary, otherwise any verified address) and drops an unverified profile email.

AuthEndpoints.OAuth.Google

• New package. AddGoogle sets email_verified from the Google userinfo payload after host configuration.

Links

• Compare
• External OAuth docs

AuthEndpoints

Hosts can set how long a ReAuth step-up stays valid. AuthEndpointsOptions.ReAuth.Lifetime defaults to 5 minutes and applies to the ReAuth cookie, confirm ExpiresUtc, and header reauthToken together. The cookie stays non-persistent with no sliding expiration. Values must be between 1 and 60 minutes.

• ReAuth.Lifetime (TimeSpan, default 5 minutes) drives cookie ExpireTimeSpan, confirm ExpiresUtc, and reauthToken expiry
• Cookie remains non-persistent (IsPersistent = false) with SlidingExpiration = false
• Startup validation rejects zero, negative, over 60 minutes, and InfiniteTimeSpan
• Composable hosts use the same IOptions<AuthEndpointsReAuthOptions>

Packages

• AuthEndpoints 3.1.0
• AuthEndpoints.External.OAuth unchanged at 3.0.0-preview.3

Links

• GitHub release
• Compare
• Installation

AuthEndpoints

Passkey login requestOptions takes JSON { "email" } instead of ?username=. Unknown or empty email still returns 200 usernameless options. MapPasskeyEndpoints fails fast at map time if the user store lacks passkey or email support.

Signed-in passkey add rejects an attestation whose user id is not the current user and does not store it. Missing credentials on delete and rename return 404. Invalid credential ids and a ceremony that is not underway return validation problems. Add accepts optional name; list and add include createdAt. Register and login apply lockout and CanSignInAsync before completing sign-in: register that cannot sign in still returns the credential id with no session, and login returns 401.

• Passkey login requestOptions takes JSON { "email" } instead of ?username=
• Unknown or empty email still returns 200 usernameless options
• MapPasskeyEndpoints fails fast at map time if the user store lacks passkey or email support
• Signed-in add rejects a mismatched attestation user id and does not store it
• Missing credentials on delete and rename return 404
• Register and login apply lockout and CanSignInAsync before completing sign-in

Packages

• AuthEndpoints 3.0.8
• AuthEndpoints.External.OAuth unchanged at 3.0.0-preview.3

Links

• GitHub release
• Compare
• Installation

AuthEndpoints

Hosts can redirect browser email confirmation to an SPA route with status and flow query params. Set EmailConfirmation.ConfirmEmailRedirectUri to a rooted path or an absolute URI so browser GET confirm-email returns 302 with status and flow instead of the thank-you body or 401. Absolute URIs stay on AllowedRedirectOrigins. Unset hosts keep the existing text response.

• Hosts can redirect browser email confirmation to an SPA route with status and flow query params
• Absolute ConfirmEmailRedirectUri values stay on AllowedRedirectOrigins
• Unset ConfirmEmailRedirectUri keeps the thank-you body or 401

Packages

• AuthEndpoints 3.0.7
• AuthEndpoints.External.OAuth unchanged at 3.0.0-preview.3

Links

• GitHub release
• Compare
• Installation

AuthEndpoints

Simple JWT refresh rotation is atomic under concurrent requests. Concurrent refresh calls against the same live refresh cookie complete with a single successor.

• Simple JWT refresh rotation is atomic under concurrent requests
• Concurrent refresh of a live cookie does not issue a second live refresh cookie

Packages

• AuthEndpoints 3.0.6
• AuthEndpoints.External.OAuth unchanged at 3.0.0-preview.3

Links

• GitHub release
• Compare
• Installation

AuthEndpoints

Passwordless passkey register sends the same confirmation email as password register after a successful account create. Register only creates a new account: the attested user id must be new. Signed-in POST /passkeys/ still adds passkeys to existing accounts.

• Confirmation email is sent after passwordless register creates a user
• Passwordless register requires a new attested user id
• Existing accounts still add passkeys via signed-in POST /passkeys/

Packages

• AuthEndpoints 3.0.5
• AuthEndpoints.External.OAuth unchanged at 3.0.0-preview.3

Links

• GitHub release
• Compare
• Installation

AuthEndpoints

Passwordless passkey registration still mints Guid.NewGuid() (UUID v4) by default. Apps can register IPasskeyUserIdFactory (or AddPasskeyUserIdFactory) to choose a different user id on RegisterOptions / Register. Cookie and Identity bearer facades are unchanged.

• Default remains Guid.NewGuid().ToString() when no factory is registered
• Passwordless register still supports only string and Guid Identity keys

Packages

• AuthEndpoints 3.0.4
• AuthEndpoints.External.OAuth unchanged at 3.0.0-preview.3

Links

• GitHub release
• Compare
• Installation

AuthEndpoints

Adds Identity bearer sign-in as a SignIn choice on the existing AddAuthEndpoints / MapAuthEndpoints facade, built from the existing management, bearer, passkey, and optional JWT modules.

• AuthEndpointsSignIn.IdentityBearer maps Identity Login (JSON access and refresh tokens) at IdentityPath
• Cookie default (AddAuthEndpoints / MapAuthEndpoints with SignIn = Cookie) is unchanged

Packages

• AuthEndpoints 3.0.3
• AuthEndpoints.External.OAuth unchanged at 3.0.0-preview.3

Links

• GitHub release
• Compare
• Installation

AuthEndpoints

Patch release on 3.0.0. Passkey register and login now call Identity CanSignInAsync before establishing a session or issuing tokens, so confirmed-account (and other Identity sign-in) policy matches password and OAuth.

• Unconfirmed register still returns the new credential without a session
• Unconfirmed login returns 401, same shape as Identity login

Packages

• AuthEndpoints 3.0.1
• AuthEndpoints.External.OAuth unchanged at 3.0.0-preview.3

Links

• GitHub release
• Compare
• Installation

AuthEndpoints.External.OAuth

• Bump to 3.0.0-preview.3 so the packed nupkg depends on AuthEndpoints 3.0.0 (published 3.0.0-preview.2 still depends on 3.0.0-rc.2)
• No OAuth feature changes; the package remains preview and is not part of the core 3.0 GA

Links

• GitHub release
• Compare
• External OAuth docs

AuthEndpoints

3.0 is the first stable release of the rewritten Identity auth stack. Last feature work was rc.4 (pluggable passkey sign-in); this cut is version and docs only.

• Opinionated facade: AddAuthEndpoints / UseAuthEndpoints / MapAuthEndpoints (cookie Identity + passkeys by default; JWT opt-in)
• Sign-in stacks you choose: cookie sessions, Identity bearer tokens, or Simple JWT (hashed refresh tokens, production issuer/audience/key validation)
• Passkeys (WebAuthn) for passwordless register and login, including pluggable IPasskeySignInCompleter<TUser> (IdentityPasskeySignInCompleter and JwtPasskeySignInCompleter)
• Account lifecycle: register, confirm email, forgot/reset password, manage info and 2FA
• Step-up ReAuth for sensitive manage and passkey mutations
• Roles-aware AddAuthEndpoints<TUser, TRole, TContext> so Identity IRoleStore registers correctly
• .NET 10 (net10.0)

Packages

• AuthEndpoints 3.0.0
• AuthEndpoints.External.OAuth remains a separate preview package (3.0.0-preview.3, retargeted at this core)

Links

• GitHub release
• Compare
• Installation

AuthEndpoints

• Added IPasskeySignInCompleter<TUser> so passkey register/login completion is pluggable (same idea as External.OAuth completers)
• Default IdentityPasskeySignInCompleter preserves cookie / Identity bearer scheme selection via useCookies / useSessionCookies
• Added JwtPasskeySignInCompleter for Simple JWT access token + refresh cookie after passwordless register/login
• Added AddPasskeyEndpoints<TUser>() and AddPasskeySignInCompleter<TUser, TCompleter>(); facade registers the generic passkey DI overload

Packages

• AuthEndpoints 3.0.0-rc.4
• AuthEndpoints.External.OAuth (unchanged)

Links

• GitHub release
• Passkeys

AuthEndpoints.External.OAuth

• Require verified email by default; auto-link by email only when verified
• Clear Identity.External cookie after successful sign-in / link
• Stricter returnUrl (relative-only by default; optional origin allowlist)
• Options validation for External settings and provider ClientId/Secret
• Browser error redirects to ErrorPath (JSON Problem when client prefers JSON)
• AddLoginRateLimiting registered from AddExternalAuthEndpoints
• JwtExternalLoginCompleter for JWT refresh-cookie completion
• MapExternalAccountEndpoints for list / link / unlink while signed in

Links

• GitHub release
• External OAuth docs

AuthEndpoints

• Added AddAuthEndpoints<TUser, TRole, TContext> so Identity roles register IRoleStore correctly (no second AddEntityFrameworkStores after AddRoles)
• Made AddLoginRateLimiting / AddIdentityEndpointRateLimiting public for compose scenarios (e.g. AuthEndpoints.External.OAuth)

Packages

• AuthEndpoints 3.0.0-rc.3
• AuthEndpoints.External.OAuth (unchanged) 3.0.0-preview.2 — requires AuthEndpoints rc.3+ for AddLoginRateLimiting

Links

• GitHub release
• Compare

AuthEndpoints.External.OAuth

• Added AuthEndpoints.External.OAuth as a separate preview NuGet package
• Shared Core: AddExternalAuthEndpoints, provisioning service, pluggable cookie completer, shared login/callback handlers
• GitHub and Google provider modules (AddGitHub / MapGitHubAuthEndpoints, AddGoogle / MapGoogleAuthEndpoints)
• Default completion issues an Identity application cookie; AddCompleter<T> for future JWT (or other) modes
• Compose-only — not wired into the AddAuthEndpoints facade

Links

• GitHub release
• External OAuth docs

Changed

• Split Identity management from sign-in so hosts can compose cookie, bearer, or JWT stacks independently
• Hardened JWT defaults (hashed refresh tokens, production issuer/audience/key validation)

Links

• GitHub release
• Compare

Added

• Opinionated facade: AddAuthEndpoints / UseAuthEndpoints / MapAuthEndpoints
• Identity cookie and bearer endpoint integration tests

Changed

• Hardened Identity and Passkey flows for the 3.0 release candidate

Links

• GitHub release
• Compare

Added

• Passwordless PasskeyEndpoints (register / login / manage credentials)

Changed

• Hardened JWT authentication and refresh-token handling

Links

• GitHub release
• Compare

Changed

• Updated the ReAuth cookie authentication scheme

Links

• GitHub release
• Compare

Added

• Cookie authentication endpoints
• Leverage official ASP.NET Core Identity API endpoints
• Step-up reauthentication via /confirmIdentity

Changed

• Reorganized and simplified project structure
• Breaking changes expected along the 3.0 alpha path

Links

• GitHub release
• Compare