Bump Duende.IdentityServer from 7.2.0 to 7.2.2

[dependabot]

Bumps Duende.IdentityServer from 7.2.0 to 7.2.2.

Release notes

Sourced from Duende.IdentityServer's releases.

IdentityServer 7.2.2

This is a patch release that

• Hardens the default configuration of the sensitive values filters and
• Fixes mTLS binding so that port numbers can be used as part of

Sensitive Values Filter Defaults

hardens the security of the default configuration that controls the redaction in logs of parameters passed to the Pushed Authorization (PAR) and Authorize endpoint, ensuring that client secrets and client assertions are not logged by default.

In particular, the default value of AuthorizeRequestSensitiveValuesFilter and PushedAuthorizationSensitiveValuesFilter have been changed to both be ["client_secret", "client_assertion", "id_token_hint"].

PAR requests sometimes are handled by the same code path as authorize requests, so this makes both filters the same by default.

mTLS port number

The MtlsOptions.DomainName can now include a port number.

Detailed Changelog

• Harden default logging filters for PAR and Authorize endpoints (7.2) by @​josephdecock in DuendeSoftware/products#1978
• Respect port number in mTLS configuration by @​josephdecock in DuendeSoftware/products#1990

Full Changelog: DuendeSoftware/products@is-7.2.1...is-7.2.2

IdentityServer 7.2.1

This is a patch release of IdentityServer that fixes a bug where a private_key_jwt client authentication token would be rejected if it had no typ header, even if strict validation of such tokens was not enabled.

What's Changed

• Handle no typ in private_key_jwt authentication by @​josephdecock in DuendeSoftware/products#1965

Commits

• 4ae59cc Merge pull request #1990 from DuendeSoftware/jmdc/mtls-port
• eb55e7b Add test cases for mTLS case insensitivity
• c7aa998 Respect port number in mTLS middleware
• 41c47c8 Add failing test cases for mtls port number
• 60566e6 Refactor mtls middleware for testability
• 5f9ebf8 Merge pull request #1978 from DuendeSoftware/jmdc/filter-default-update-7.2
• 42b1c53 Merge branch 'jmdc/filter-default-update-7.1' into jmdc/filter-default-update...
• 427502c Merge default filter update to 7.1
• f684baa Harden default logging filters for PAR and Authorize endpoints
• ba4e8b5 Backport mock logger
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #70.