Question 1

Is AspNet.Security.OpenIdConnect.Server still being actively developed?

Accepted Answer

No, it has been merged into OpenIddict, so for new projects, it's recommended to use OpenIddict, which builds upon ASOS and offers more features and ongoing support. The README explicitly states this with a warning banner.

Question 2

How do I implement a custom grant type in ASOS?

Accepted Answer

You can use the OnValidateTokenRequest and OnHandleTokenRequest event handlers to add support for non-standard grant types, but it requires manual implementation of all security checks, as shown in the README examples for password and refresh token flows.

Question 3

ASOS vs OpenIddict: which one should I choose?

Accepted Answer

Choose ASOS if you need absolute control over protocol details for a custom server, such as for educational or highly specific use cases. Choose OpenIddict for a more streamlined, feature-rich solution with better maintenance and community support, as it's the successor project.

Question 4

Can ASOS be used with the latest versions of ASP.NET Core?

Accepted Answer

The README mentions support up to ASP.NET Core 2.x. For ASP.NET Core 3.0 or later, compatibility might be limited, and OpenIddict is a better alternative, as it targets newer .NET versions.

Question 5

What are the security best practices when using ASOS?

Accepted Answer

The framework emphasizes using key derivation functions like PBKDF2 for secret validation and time-constant comparers to prevent timing attacks, as highlighted in the README comments for mitigating brute force attacks.

Question 6

How to handle refresh tokens in ASOS?

Accepted Answer

Refresh tokens are supported via the offline_access scope; you need to implement logic in OnHandleTokenRequest to validate and issue new access tokens based on refresh tokens, similar to the password grant example in the README.

AspNet.Security.OpenIdConnect.Server

What is AspNet.Security.OpenIdConnect.Server?

Overview

Use Cases

Best For

Related Projects

Found a gem we're missing?

Not Ideal For

Pros & Cons

Pros

Cons

Frequently Asked Questions