24 lines
2.7 KiB
Markdown
24 lines
2.7 KiB
Markdown
# .NET and Authenticated Encryption Upgrade
|
|
|
|
Date started: 2026-10-16
|
|
|
|
## Framework and Common Alignment
|
|
|
|
All Saxonite projects have been retargeted from .NET 6 to .NET 10. The solution's relative references now resolve to sibling `Common-VS/Workspace`; `SaxoniteStandardBase` references Common's `SacsBusinessBase` for the shared item option definition. Razor runtime compilation was moved to 10.0.12, and redundant legacy `System.Collections.Specialized` and ASP.NET Identity package references were removed where the framework/API now supplies the needed surface.
|
|
|
|
Restore and Debug build completed. The build succeeds; restore reports inherited package vulnerability advisories detailed below. All three test projects pass (Admin: 7 tests; Online: 7 tests; Shared: 37 tests). Coverage includes purpose isolation, tamper rejection, omission of IV fields from serialized session data, representative shared bus rules and XML serialization, and Admin/Online model behavior.
|
|
|
|
## Authenticated Encryption
|
|
|
|
Saxonite callers now use Common's purpose-bound `SACSENC2.` AES-GCM wrappers with distinct purposes for Admin and Online parameters, keep-logged-in cookies, password-reset links, and Online ID obfuscation. Fixed and session IV state has been removed from application session data and reset-link encryption. Decryption remains fail-closed with no legacy CBC fallback.
|
|
|
|
This is an intentional clean break. Existing encrypted keep-logged-in cookies, password-reset links, and encrypted session/query parameters will no longer decrypt and users may need to sign in again or request a new password-reset link. Admin and Online purposes are separated even where they share key material. Common's migration record is [`../../../Common-VS/Workspace/docs/authenticated-encryption-migration.md`](../../../Common-VS/Workspace/docs/authenticated-encryption-migration.md).
|
|
|
|
## Remaining Validation and Package Work
|
|
|
|
Saxonite's three test projects now use the aligned test stack: NUnit 4.6.1, NUnit3TestAdapter 6.3.1, NUnit.Analyzers 4.15.0, Microsoft.NET.Test.Sdk 18.11.0, Moq 4.21.0, and coverlet.collector 10.1.0. Existing test cases were migrated from MSTest attributes and assertions. The tests are a targeted baseline, not a full coverage measure.
|
|
|
|
The restore reports moderate and high severity advisories for Common's `SixLabors.ImageSharp` 3.1.12 and `System.Security.Cryptography.Xml`/`Pkcs` 10.0.12 (with `Pkcs` 10.0.0 also in part of the graph). These package references belong to Common projects and are outside the Saxonite upgrade scope. Reassess after Common is updated independently.
|
|
|
|
Runtime validation with machine-specific configuration and database access remains outstanding. The current tests are focused unit tests and do not verify deployment configuration or production flows.
|