• Security Fix: Bind state and assertion to response issuer.
• Security Fix: Bind request state to module path to prevent substitution.

• Security Fix: Bind state and assertion to response issuer.
• Security Fix: Bind request state to module path to prevent substitution.

support modern crypto providers

• Add runtime detection for .NET 5+
• Deserialize LogoutResponse

Add runtime detection for .NET 5
Enable adding support for AES-GCM (http:https://www.w3.org/2009/xmlenc11#aes128-gcm)
Bug fix: Do not crash on duplicate language entries for localized strings in metadata

• Security Fix: Ensure received token is a bearer token.
• Compatibility flag to allow unsigned logout responses

• Security Fix: Ensure received token is a bearer token.

• Xml Created Notifications

• Security Fix: Token Replay Detection
• Configuration of TokenValidationParameters
• Use CookieManager in Asp.Net Core and Owin
• Bug fixes to Artifact binding, AuthnRequest, Owin Logout

See GitHub milestone issue list for details.

• SameSite cookie update for Chrome 80
• TokenValidationParametersCreated notification
• Bug Fix: Handle query string with =
• Improved error messages