.NET 11 RC2 Adds Enhancements to ASP.NET Core Authentication and Security
The second release candidate for .NET 11 introduces improved authorization policies, support for TLS channel binding, and performance-focused data protection interfaces.
.NET 11 RC2 includes updates to ASP.NET Core authentication, authorization, and Data Protection. Tore Nestenius compared .NET 10.0.1, .NET 10.0.13, and .NET 11 RC2, finding that fixes for .NET 11 shipped in .NET 10 servicing updates.
The cookie handler gets no public API changes. An app using an ITicketStore via CookieAuthenticationOptions.SessionStore now creates a new stored session when a user signs out and signs back in during the same HTTP request. The handler also rejects certain non-printing characters in the ReturnUrl query string, a change already in .NET 10.0.13.
The Negotiate handler uses TLS channel binding in RC2 when available. .NET 10.0.13 and .NET 11 RC2 include LDAP account and group lookup fixes. Certificate authentication validation caches now include the scheme name alongside the certificate hash.
Authorization adds an AuthorizationPolicy.CombineAsync overload to build combined policies from endpoint metadata, and failure logs now include reasons from AuthorizationFailureReason. Data Protection introduces ISpanDataProtector using ReadOnlySpan<byte> and IBufferWriter<byte>.
OpenID Connect, JwtBearer, BearerToken, Facebook, Google, MicrosoftAccount, Twitter, and WsFederation handlers show no major changes. OpenID Connect includes a CSRF compatibility fix. The experimental Microsoft.AspNetCore.Authentication.DeviceBoundSessions package from RC1 was removed before RC2.