Bump Auth0.AspNetCore.Authentication from 1.9.0 to 1.11.0

[dependabot]

Updated Auth0.AspNetCore.Authentication from 1.9.0 to 1.11.0.

Release notes

Sourced from Auth0.AspNetCore.Authentication's releases.

1.11.0

Added

• Mutual TLS (mTLS) support #​279 (kailash-b) - applications can now authenticate to Auth0 with a client certificate instead of a client secret or client assertion (RFC 8705). Access tokens can additionally be certificate-bound, so a stolen token cannot be replayed without the corresponding private key - aimed at highly-regulated, holder-of-key scenarios. The feature is opt-in and additive; the application owns and manages the certificate. Misconfiguration (combining mTLS with a client secret, client assertion, or custom backchannel) is caught at startup.
• Impersonation via Session Transfer #​273 (kailash-b) - builds on the existing Custom Token Exchange support to let an initiator app (e.g. a support/admin console) start an authenticated session in a target app as a customer, with the agent recorded in the act claim. The initiator requests a short-lived, single-use Session Transfer Token and redirects the agent's browser to the target app carrying that token.

Security

• chore(deps): Bump System.Text.Encodings.Web from 10.0.10 to 10.0.11 #​278 (dependabot[bot])

1.10.0

Added

• Upstream IdP session expiry (IPSIE SL1) enforcement #​272 (tanya732) - when Auth0 brokers an upstream identity provider that enforces its own session lifetime, that ceiling now caps the session in the application too, so a user is not kept signed in past the point the upstream IdP considers their session over. Enforcement is automatic and requires no code opt-in; it activates only when the connection emits a session_expiry claim (Unix seconds) on the ID token (connection option id_token_session_expiry_supported).

Security

• Bump dependencies #​274 (dependabot[bot]) - consolidates several Dependabot bumps (supersedes #​267, #​271): Microsoft.IdentityModel.Protocols.OpenIdConnect 8.19.2 → 8.22.0.
• Dependency updates #​266 (kailash-b) - bundles a set of routine Dependabot updates keeping both the NuGet package references and GitHub Actions workflow versions current.
  • NuGet packages: Microsoft.AspNetCore.Mvc.Testing 10.0.9 → 10.0.10, Microsoft.IdentityModel.Protocols.OpenIdConnect 8.19.1 → 8.19.2, Microsoft.NET.Test.Sdk 18.6.0 → 18.8.1, System.Text.Encodings.Web 10.0.9 → 10.0.10.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)