Open.IdentityServer

• Fix an additional null handling issue when using a Duende database and the keys table is empty. (fbabaf)
• Fix DistributedCacheAuthorizationParametersMessageStore.DeleteAsync improperly formatting cache keys. (c3aaf4)

Download on nuget.org or view the release on GitHub

• Fix Null Ref Exception when using CompatibilityKeyStore and the underlying storage is empty. (8cc0d4)
• dded MaxLifetime option for keys when using CompatibilityKeyStore. Default is 90 days. Previously it was possible for expired keys to be used if they were set to not be deleted after expiry in Duende IdentityServer. (ba038a)
• Fix audience claims not being mapped to token audiences in IdentityServerTools (90047b)

Download on nuget.org or view the release on GitHub

• Added support for Resource Indicators RFC 8707 (c613bd)
• Added persisted grant data protection (85703c)

• CVE-2024-39694, open redirect vulnerability fixed (6ccfbd)
• When creating token payload, ignore custom claims used for token validation (e.g. aud, iat, etc) (3ed930)
• Remove Nonce requirement when not asking for an ID tokens from the Auth Endpoint (375570)
• Update custom redirect result to make return url construction similar to that of login and consent (970529)
• Post logout in app auth validator using wrong uri list (678dd2)
• Custom Redirect return URL callback incorrect (cb7027)
• Fix GetAuthorizationContextAsync to return multiple query values from returnUrl (e62a27)
• Access tokens created by during refresh tokens flows do not generate new JTI claims (ef57c3)
• Added authorise response parameter 'iss' (cb3f87)
• Set refresh token usage to reuse by default (00f076)

Download on nuget.org or view the release on GitHub