Joseph Doherty 3ddb6876db fix(security): first-party JwtBearer with HS256 pinned; /auth/token mints for a cookie session only ...

The hand-rolled bearer handler is replaced by AddJwtBearer (Microsoft.AspNetCore.Authentication.JwtBearer
10.0.7, pinned on the same servicing line as the other AspNetCore packages). Validation parameters come
from JwtTokenService.BuildValidationParameters, which now pins ValidAlgorithms = HS256 for both the
bearer scheme and TryValidate; MapInboundClaims is off so the minted Role/zb:username keys resolve.
/auth/token requires the cookie scheme, so a bearer can no longer mint a fresh token for itself.

Refs #733
Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT

2026-10-22 13:35:54 -04:00

..

Client

fix(client): keep advertised port for a port-less URL; narrow history refusal catch to unwrapped faults (L4 review)

2026-10-11 10:48:20 -04:00

Core

Merge branch 'master' into remed/lane-C

2026-10-22 13:31:03 -04:00

Drivers

feat(historian): ServerHistorian:MaxRawValuesPerRead caps raw pages and backend reads

2026-10-22 06:29:10 -04:00

Server

fix(security): first-party JwtBearer with HS256 pinned; /auth/token mints for a cookie session only

2026-10-22 13:35:54 -04:00

TestSupport

test: guarantee driver fixture cleanup without masking failures

2026-10-13 16:36:38 -04:00

Tooling/ZB.MOM.WW.OtOpcUa.Analyzers.Tests

refactor(#655): delete the dead driver-side history capability

2026-10-08 23:34:02 -04:00