Skip to content

Verify external providers are using latest APIs #4684

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
Tratcher opened this issue Nov 13, 2014 · 30 comments
Open

Verify external providers are using latest APIs #4684

Tratcher opened this issue Nov 13, 2014 · 30 comments
Labels
affected-most This issue impacts most of the customers area-auth Includes: Authn, Authz, OAuth, OIDC, Bearer severity-minor This label is used by an internal tool task
Milestone
.NET 10 Planning

Comments

@Tratcher
Copy link
Member

RTM milestone.

External login providers routinely update their APIs and deprecate the old ones. Before we ship RTM we need to verify that each of our implementations is targeting the latest provider API versions to ensure our packages have the longest useful lifespan.

Example: #85
@brentschmaltz
Copy link
Contributor

What is the definition for an 'External login provider'?

@Praburaj
Copy link

Like Google, Facebook, Twitter, MicrosoftAccount etc.

@Tratcher
Copy link
Member Author

FYI: Facebook is up to v2.4: https://developers.facebook.com/blog/post/2015/07/08/graph-api-v2.4/
https://katanaproject.codeplex.com/workitem/417
aspnet/Security#365

@Tratcher Tratcher assigned Tratcher and JunTaoLuo and unassigned Tratcher and JunTaoLuo Oct 29, 2015
@Tratcher Tratcher removed their assignment Nov 18, 2015
@muratg
Copy link
Contributor

muratg commented Nov 19, 2015

Let's have a look in RC2.

@Tratcher
Copy link
Member Author

MSA: aspnet/Security#691

@HaoK
Copy link
Member

HaoK commented May 20, 2016 •
edited
Loading

Google Token Endpoint to v4: aspnet/Security#829

@HaoK
Copy link
Member

HaoK commented May 20, 2016

FB to v2.6 aspnet/Security#828

@HaoK
Copy link
Member

HaoK commented May 20, 2016

Twitter looks fine

@HaoK HaoK closed this as completed May 23, 2016
@Tratcher
Copy link
Member Author

Reviving for the next release.

@Tratcher Tratcher reopened this May 23, 2016
@HaoK
Copy link
Member

HaoK commented May 23, 2016

Its the zombie issue, that will never die...

@Tratcher Tratcher self-assigned this Jul 8, 2017
@Tratcher
Copy link
Member Author

Tratcher commented Jul 8, 2017

ping @muratg @Eilon reviving this for 2.0 signoff.

@Eilon
Copy link
Member

Eilon commented Jul 19, 2017

@Tratcher - anything we need to do for 2.0 RTM?

@Tratcher
Copy link
Member Author

Tratcher commented Jul 19, 2017 •
edited
Loading

I did a pass recently and filed some non-blocking bugs linked above. Move this to 2.1? We should avoid ever putting this issue in the backlog, only the next release.

@Eilon
Copy link
Member

Eilon commented Jul 19, 2017

Ok.

@blowdart
Copy link
Contributor

blowdart commented Feb 7, 2018

Bringing this front and center. Facebook is now at 2.12 and 2.6 will expire in July this year.

@Tratcher
Copy link
Member Author

Tratcher commented Feb 7, 2018

See aspnet/Security#1306 for Facebook

@Tratcher
Copy link
Member Author

Facebook and Google fixed for 2.1. Twitter and MSA do not appear to require any updates. Punting this zombie issue to 2.2.0.

@Tratcher Tratcher removed their assignment Feb 28, 2018
@Tratcher Tratcher added affected-most This issue impacts most of the customers severity-minor This label is used by an internal tool labels Nov 10, 2020 — with ASP.NET Core Issue Ranking
@Tratcher Tratcher self-assigned this Sep 2, 2021
@Tratcher Tratcher mentioned this issue Sep 8, 2021
Merged
@Tratcher
Copy link
Member Author

Tratcher commented Sep 8, 2021 •
edited
Loading

Updated Facebook to v11 for .NET 6 rc2. Other providers are up to date.

Revisit late in .NET 7.

@Tratcher Tratcher modified the milestones: 6.0-rc2, .NET 7 Planning Sep 8, 2021
@Tratcher Tratcher removed their assignment Sep 8, 2021
@Tratcher Tratcher self-assigned this Sep 13, 2022
Tratcher added a commit to Tratcher/aspnetcore that referenced this issue Sep 14, 2022
@Tratcher
Update facebook OAuth API version to 14 dotnet#4684
b6a10c6
Tratcher added a commit to Tratcher/aspnetcore that referenced this issue Sep 14, 2022
@Tratcher
Update google oauth user info endpoint to v3 dotnet#4684
beda821
@Tratcher Tratcher mentioned this issue Sep 14, 2022
Merged
@ghost
Copy link

ghost commented Sep 14, 2022

Thanks for contacting us.

We're moving this issue to the .NET 8 Planning milestone for future evaluation / consideration. We would like to keep this around to collect more feedback, which can help us with prioritizing this work. We will re-evaluate this issue, during our next planning meeting(s).
If we later determine, that the issue has no community involvement, or it's very rare and low-impact issue, we will close it - so that the team can focus on more important and high impact issues.
To learn more about what to expect next and how this issue will be handled you can read more about our triage process here.

@Tratcher Tratcher removed their assignment Sep 14, 2022
Tratcher added a commit that referenced this issue Sep 15, 2022
@Tratcher
Update facebook OAuth API version to 14, google to v3 (#43982)
1ea90cc 
* Update facebook OAuth API version to 14 #4684
* Update google oauth user info endpoint to v3 #4684
@FranklinWhale
Copy link
Contributor

Both Google and Facebook support PKCE now:
https://developers.google.com/identity/protocols/oauth2/native-app#step1-code-verifier
https://developers.facebook.com/docs/facebook-login/guides/advanced/oidc-token

Should UsePkce of GoogleOptions and FacebookOptions be set to true by default?

@Tratcher
Copy link
Member Author

@FranklinWhale have you tried it? If it works feel free to send us a PR.

@FranklinWhale
Copy link
Contributor

@FranklinWhale have you tried it? If it works feel free to send us a PR.

Ya, both of them can detect invalid code verifier. I will submit a PR later :)

Should the tests for Google and Facebook be similar to the one for Microsoft account in #10928?

@Tratcher
Copy link
Member Author

Yes, the tests will look similar to the Microsoft ones.

@FranklinWhale FranklinWhale mentioned this issue Nov 22, 2022
Merged
4 tasks
@NSTom NSTom mentioned this issue Dec 9, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
affected-most This issue impacts most of the customers area-auth Includes: Authn, Authz, OAuth, OIDC, Bearer severity-minor This label is used by an internal tool task
Projects
None yet
Milestone
.NET 10 Planning
Development

No branches or pull requests