ComponentSpace SAML for ASP.NET v8.3.0 updates:
- Moved the database-related classes to a separate ComponentSpace.SAML2.Extension.Database package.
- Removed the UseEmbeddedCertificate configuration property to avoid exposing a low-level security-sensitive configuration option.
- Added limits for HTTP-Redirect DEFLATE data and SAML message sizes to provide additional protection against excessively large requests.
- Added the EnableTripleDesSupport configuration property and disable 3DES support by default.
- Added the DisabledDigestAlgorithms, DisabledSignatureAlgorithms and DisabledDataEncryptionAlgorithms options to programmatically control support for legacy algorithms. SHA-1 and 3DES support is disabled by default.
- Added the AllowUnsignedAssertionAndResponse option to control whether unsigned SAML responses containing unsigned assertions are permitted when no signing requirement is configured. By default, they are not permitted.
- Updated the NuGet package dependencies to their latest versions.
ComponentSpace SAML for ASP.NET Core v6.3.0 updates:
- Removed the dependency on Newtonsoft.Json.
- Removed the UseEmbeddedCertificate configuration property to avoid exposing a low-level security-sensitive configuration option.
- Added limits for HTTP-Redirect DEFLATE data and SAML message sizes to provide additional protection against excessively large requests.
- Added the EnableTripleDesSupport configuration property and disable 3DES support by default.
- Added the DisabledDigestAlgorithms, DisabledSignatureAlgorithms and DisabledDataEncryptionAlgorithms options to programmatically control support for legacy algorithms. SHA-1 and 3DES support is disabled by default.
- Added the AllowUnsignedAssertionAndResponse option to control whether unsigned SAML responses containing unsigned assertions are permitted when no signing requirement is configured. By default, they are not permitted.
- Updated the NuGet package dependencies to their latest versions.