{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/AspNetCore/issues/3774","repository_url":"https://api.github.com/repos/aspnet/AspNetCore","labels_url":"https://api.github.com/repos/aspnet/AspNetCore/issues/3774/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/AspNetCore/issues/3774/comments","events_url":"https://api.github.com/repos/aspnet/AspNetCore/issues/3774/events","html_url":"https://github.com/aspnet/AspNetCore/issues/3774","id":375995861,"node_id":"MDU6SXNzdWUzNzU5OTU4NjE=","number":3774,"title":"Consider moving ASP.NET Core Data Protection to Microsoft.Extensions.*","user":{"login":"PinpointTownes","id":6998306,"node_id":"MDQ6VXNlcjY5OTgzMDY=","avatar_url":"https://avatars1.githubusercontent.com/u/6998306?v=4","gravatar_id":"","url":"https://api.github.com/users/PinpointTownes","html_url":"https://github.com/PinpointTownes","followers_url":"https://api.github.com/users/PinpointTownes/followers","following_url":"https://api.github.com/users/PinpointTownes/following{/other_user}","gists_url":"https://api.github.com/users/PinpointTownes/gists{/gist_id}","starred_url":"https://api.github.com/users/PinpointTownes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PinpointTownes/subscriptions","organizations_url":"https://api.github.com/users/PinpointTownes/orgs","repos_url":"https://api.github.com/users/PinpointTownes/repos","events_url":"https://api.github.com/users/PinpointTownes/events{/privacy}","received_events_url":"https://api.github.com/users/PinpointTownes/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-10-31T14:40:15Z","updated_at":"2018-10-31T15:02:32Z","closed_at":null,"author_association":"NONE","body":"[@davidfowl asked for concrete examples](https://github.com/aspnet/AspNetCore/issues/3753#issuecomment-434253160) of things people would like to use outside ASP.NET Core, that will be limited to .NET Core starting with 3.0.\r\n\r\nSome of the OWIN/Katana apps I've worked on rely on the `Microsoft.Owin.Security.Interop` backcompat' package to be able to share things like cookies and authentication tokens with more recent ASP.NET Core apps. This package depends on the shiny ASP.NET Core Data Protection, which currently lives in the `Microsoft.AspNetCore.DataProtection` namespace.\r\n\r\nMy request is simple: please consider moving the DP components to `Microsoft.Extensions.DataProtection` and keeping them compatible with .NET Standard (and .NET Framework)."},"comment":{"url":"https://api.github.com/repos/aspnet/AspNetCore/issues/comments/434721635","html_url":"https://github.com/aspnet/AspNetCore/issues/3774#issuecomment-434721635","issue_url":"https://api.github.com/repos/aspnet/AspNetCore/issues/3774","id":434721635,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNDcyMTYzNQ==","user":{"login":"PinpointTownes","id":6998306,"node_id":"MDQ6VXNlcjY5OTgzMDY=","avatar_url":"https://avatars1.githubusercontent.com/u/6998306?v=4","gravatar_id":"","url":"https://api.github.com/users/PinpointTownes","html_url":"https://github.com/PinpointTownes","followers_url":"https://api.github.com/users/PinpointTownes/followers","following_url":"https://api.github.com/users/PinpointTownes/following{/other_user}","gists_url":"https://api.github.com/users/PinpointTownes/gists{/gist_id}","starred_url":"https://api.github.com/users/PinpointTownes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PinpointTownes/subscriptions","organizations_url":"https://api.github.com/users/PinpointTownes/orgs","repos_url":"https://api.github.com/users/PinpointTownes/repos","events_url":"https://api.github.com/users/PinpointTownes/events{/privacy}","received_events_url":"https://api.github.com/users/PinpointTownes/received_events","type":"User","site_admin":false},"created_at":"2018-10-31T15:02:32Z","updated_at":"2018-10-31T15:02:32Z","author_association":"NONE","body":"> I'm confused why you, of all people, don't just share logins via OIDC, you wrote an entire system for that.\r\n\r\nI do use OIDC to \"share logins\", but this standard alone is not the only one involved in the token authentication dance. Not everyone wants to always use JWT for their access tokens: I’m one of those guys.\r\n\r\nIn the \"system I wrote\" tokens are by default created using ASP.NET Core Data Protection, which has many advantages over JWT, like an almost configuration-less experience, a very high security level and a huge perf boost (between +15% and +20% req/sec compared to HMACed JWTs encrypted using a symmetric AES key).\r\n\r\nWith the compat package, we can have OWIN/Katana/ASP.NET 4.x API projects that accept DP access tokens issued by an ASP.NET Core app. "}}
{"actor":{"display_login":"PinpointTownes"}}