Chris Ross

No, ANCM should have 1.0 and 1.1 regression test projects regardless of moving to universe.

One way to deal with this is to move the retrieval to a background task. Have IssuerSigningKeyResolver always use the last known value, while periodically updating up. We did something...

Code access security (CAS) has been obsolete since .NET 4. https://docs.microsoft.com/en-us/dotnet/framework/misc/code-access-security-policy-compatibility-and-migration#:~:text=The%20policy%20portion%20of%20code%20access%20security%20%28CAS%29,can%20avoid%20the%20warnings%20and%20errors%20by%20either%3A

Yes, the WsFed example forces a blocking retrieval from the constructor. https://github.com/aspnet/AspNetKatana/blob/e2b18ec84ceab7ffa29d80d89429c9988ab40144/src/Microsoft.Owin.Security.ActiveDirectory/WsFedCachingSecurityKeyProvider.cs#L51

Someone tried this dependency update recently over at https://github.com/rzontar/pkce/tree/package-update. It seems to build and the tests pass. That should have caught any API breaks.

That code is here: https://github.com/aspnet/AspNetKatana/blob/569f1c872e86e57155d7865f4b3d627949cfcba2/src/Microsoft.Owin.StaticFiles/DirectoryFormatters/HtmlDirectoryFormatter.cs#L115-L138 It is HtmlEncoding the folder name via WebUtility: https://github.com/aspnet/AspNetKatana/blob/569f1c872e86e57155d7865f4b3d627949cfcba2/src/Microsoft.Owin.StaticFiles/DirectoryFormatters/HtmlDirectoryFormatter.cs#L152-L155 Hmm, maybe that should be url encoded before html encoding it. Or the href portion and...

That said, '&' is a valid url path character. I wonder why it's being filtered. Looks like a common complaint: https://www.hanselman.com/blog/ExperimentsInWackinessAllowingPercentsAnglebracketsAndOtherNaughtyThingsInTheASPNETIISRequestURL.aspx

The handlers are disposed too soon, causing unnecessary failures. We'd have to figure out a better signal to dispose them before answering questions about breaking changes.

The list was copied from IIS a long time ago and never updated. We try to avoid adding everything, but json is a reasonable one. This was added to ASP.NET...

Zombie issue. Moving to next-sprint-planning to revisit for the next release.