From 10ef3c0a30ef1900c4c0912c9a66211c7ab65045 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 12 Aug 2026 15:53:52 +0000 Subject: [PATCH 1/4] Initial plan From 37c4b9581869303f16b386e3e8dce6a59eb7564f Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 12 Aug 2026 15:57:35 +0000 Subject: [PATCH 2/4] Add Preview 7 What's New includes and article updates Co-authored-by: wadepickett <10985336+wadepickett@users.noreply.github.com> --- aspnetcore/release-notes/aspnetcore-11.md | 14 +++++- ...istent-authorization-metadata-preview-7.md | 18 ++++++++ .../openapi-server-sent-events-preview-7.md | 41 ++++++++++++++++++ ...ignalr-auth-refresh-redirects-preview-7.md | 7 +++ .../tls-channel-binding-token-preview-7.md | 26 +++++++++++ ...ibutes-no-longer-experimental-preview-7.md | 3 ++ .../validation-localization-preview-7.md | 43 +++++++++++++++++++ 7 files changed, 151 insertions(+), 1 deletion(-) create mode 100644 aspnetcore/release-notes/aspnetcore-11/includes/consistent-authorization-metadata-preview-7.md create mode 100644 aspnetcore/release-notes/aspnetcore-11/includes/openapi-server-sent-events-preview-7.md create mode 100644 aspnetcore/release-notes/aspnetcore-11/includes/signalr-auth-refresh-redirects-preview-7.md create mode 100644 aspnetcore/release-notes/aspnetcore-11/includes/tls-channel-binding-token-preview-7.md create mode 100644 aspnetcore/release-notes/aspnetcore-11/includes/validation-attributes-no-longer-experimental-preview-7.md create mode 100644 aspnetcore/release-notes/aspnetcore-11/includes/validation-localization-preview-7.md diff --git a/aspnetcore/release-notes/aspnetcore-11.md b/aspnetcore/release-notes/aspnetcore-11.md index 7b0939b54148..2371368f9d7b 100644 --- a/aspnetcore/release-notes/aspnetcore-11.md +++ b/aspnetcore/release-notes/aspnetcore-11.md @@ -4,7 +4,7 @@ ai-usage: ai-assisted author: wadepickett description: Learn about the new features in ASP.NET Core in .NET 11. ms.author: wpickett -ms.date: 07/21/2026 +ms.date: 08/12/2026 uid: aspnetcore-11 --- # What's new in ASP.NET Core in .NET 11 @@ -33,6 +33,8 @@ This section describes new features for SignalR. [!INCLUDE[](~/release-notes/aspnetcore-11/includes/signalr-cancel-hub-invocations-preview-6.md)] +[!INCLUDE[](~/release-notes/aspnetcore-11/includes/signalr-auth-refresh-redirects-preview-7.md)] + ## Minimal APIs This section describes new features for Minimal APIs. @@ -45,6 +47,10 @@ This section describes new features for Minimal APIs. [!INCLUDE[](~/release-notes/aspnetcore-11/includes/short-circuit-endpoints-attribute-preview-6.md)] +[!INCLUDE[](~/release-notes/aspnetcore-11/includes/validation-localization-preview-7.md)] + +[!INCLUDE[](~/release-notes/aspnetcore-11/includes/validation-attributes-no-longer-experimental-preview-7.md)] + ## OpenAPI This section describes new features for OpenAPI. @@ -61,6 +67,8 @@ This section describes new features for OpenAPI. [!INCLUDE[](~/release-notes/aspnetcore-11/includes/openapi-3-2-default-preview-6.md)] +[!INCLUDE[](~/release-notes/aspnetcore-11/includes/openapi-server-sent-events-preview-7.md)] + ## Authentication and authorization This section describes new features for authentication and authorization. @@ -71,6 +79,8 @@ This section describes new features for authentication and authorization. [!INCLUDE[](~/release-notes/aspnetcore-11/includes/user-jwts-file-based-apps-preview-6.md)] +[!INCLUDE[](~/release-notes/aspnetcore-11/includes/consistent-authorization-metadata-preview-7.md)] + ## Miscellaneous This section describes miscellaneous new features in .NET 11. @@ -99,6 +109,8 @@ This section describes miscellaneous new features in .NET 11. [!INCLUDE[](~/release-notes/aspnetcore-11/includes/kestrel-trailer-header-timeouts-preview-5.md)] +[!INCLUDE[](~/release-notes/aspnetcore-11/includes/tls-channel-binding-token-preview-7.md)] + ## Breaking changes Use the articles in [Breaking changes in .NET](/dotnet/core/compatibility/breaking-changes) to find breaking changes that might apply when upgrading an app to a newer version of .NET. diff --git a/aspnetcore/release-notes/aspnetcore-11/includes/consistent-authorization-metadata-preview-7.md b/aspnetcore/release-notes/aspnetcore-11/includes/consistent-authorization-metadata-preview-7.md new file mode 100644 index 000000000000..38f723bf2f28 --- /dev/null +++ b/aspnetcore/release-notes/aspnetcore-11/includes/consistent-authorization-metadata-preview-7.md @@ -0,0 +1,18 @@ +### Consistent authorization metadata across the stack + +Authorization metadata can be expressed as , an , or an attribute. MVC filters, SignalR hub methods, and Blazor's `AuthorizeView` and `AuthorizeRouteView` apply all three forms consistently. + + + +A new `AuthorizationPolicy.CombineAsync` overload is the shared implementation: + +```csharp +public class AuthorizationPolicy +{ + public static Task CombineAsync( + IAuthorizationPolicyProvider policyProvider, + IEnumerable metadata); +} +``` + +MVC, SignalR, and Blazor use this overload internally. A custom attribute that implements both and contributes to the decision once. The legacy MVC path with `EnableEndpointRouting = false` is unchanged. diff --git a/aspnetcore/release-notes/aspnetcore-11/includes/openapi-server-sent-events-preview-7.md b/aspnetcore/release-notes/aspnetcore-11/includes/openapi-server-sent-events-preview-7.md new file mode 100644 index 000000000000..1f3fdded49fb --- /dev/null +++ b/aspnetcore/release-notes/aspnetcore-11/includes/openapi-server-sent-events-preview-7.md @@ -0,0 +1,41 @@ +### OpenAPI Server-Sent Events in OpenAPI 3.2 + +Endpoints that return `SseItem` are described in the generated OpenAPI document with the OpenAPI 3.2 `itemSchema` shape for `text/event-stream` responses. The `itemSchema` describes a stream's per-event payload shape instead of falling back to a plain `string` schema. + +```csharp +app.MapGet("/todos/stream", (CancellationToken ct) => + TypedResults.ServerSentEvents(GetTodosAsync(ct))) + .WithName("StreamTodos"); + +static async IAsyncEnumerable> GetTodosAsync( + [EnumeratorCancellation] CancellationToken ct = default) +{ + foreach (var todo in Todos.All) + { + yield return new SseItem(todo) { EventId = todo.Id.ToString() }; + await Task.Delay(1000, ct); + } +} +``` + +Return the stream through `TypedResults.ServerSentEvents`. A handler that returns `IAsyncEnumerable>` directly is serialized as JSON instead of SSE. Use the dedicated `SseItem` overload without `eventType`. To use one event name for the whole stream, pass a plain `IAsyncEnumerable` with `eventType`. + +The generated 3.2 document describes the event payload with `itemSchema` referencing `#/components/schemas/Todo`, plus the standard SSE `event` and `id` string fields: + +```yaml +responses: + '200': + description: OK + content: + text/event-stream: + itemSchema: + type: object + required: [data] + properties: + data: + $ref: '#/components/schemas/Todo' + event: { type: string } + id: { type: string } +``` + +If the event payload is a discriminated union (a preview C# 14 feature), OpenAPI also emits the union's case names as an `enum` on the `event` field. diff --git a/aspnetcore/release-notes/aspnetcore-11/includes/signalr-auth-refresh-redirects-preview-7.md b/aspnetcore/release-notes/aspnetcore-11/includes/signalr-auth-refresh-redirects-preview-7.md new file mode 100644 index 000000000000..607aed10e44d --- /dev/null +++ b/aspnetcore/release-notes/aspnetcore-11/includes/signalr-auth-refresh-redirects-preview-7.md @@ -0,0 +1,7 @@ +### SignalR .NET client supports authentication refresh after redirects + +The SignalR .NET client extends [SignalR authentication refresh](#signalr-authentication-refresh) so it works when negotiate redirects to another server, contributed by [@MoChilia](https://github.com/MoChilia). This client change enables support for redirecting servers such as Azure SignalR Service, but Azure SignalR Service hasn't enabled the feature yet. + +The client preserves the app-token provider across the redirect, adopts a refreshed transport token from the response, and retains `tokenLifetimeSeconds` so automatic refresh remains scheduled after the original token expires. + +Thank you [@MoChilia](https://github.com/MoChilia) for this contribution! diff --git a/aspnetcore/release-notes/aspnetcore-11/includes/tls-channel-binding-token-preview-7.md b/aspnetcore/release-notes/aspnetcore-11/includes/tls-channel-binding-token-preview-7.md new file mode 100644 index 000000000000..d37a5cc44d80 --- /dev/null +++ b/aspnetcore/release-notes/aspnetcore-11/includes/tls-channel-binding-token-preview-7.md @@ -0,0 +1,26 @@ +### TLS channel-binding token access from `ITlsConnectionFeature` + +Applications using TLS can read the connection's channel binding token to defend against relay attacks: + +```csharp +using System.Security.Authentication.ExtendedProtection; + +app.Use(async (context, next) => +{ + var tls = context.Features.Get(); + if (tls is not null && tls.TryGetChannelBindingBytes( + ChannelBindingKind.Endpoint, + out ReadOnlyMemory cbt)) + { + // Compare cbt against the token the client presented during authentication. + } + + await next(context); +}); +``` + +Kestrel returns the binding from `SslStream.TransportContext.GetChannelBinding`. IIS and HTTP.sys return it from the request. On HTTP.sys, `HttpSysOptions.HttpAuthenticationHardeningLevel` controls Extended Protection and channel-binding token exposure: + +* `Legacy` disables channel-binding validation and doesn't expose the token. +* `Medium`, the default, exposes the token and validates it when supplied, but tolerates its absence. +* `Strict` requires the token for authenticated requests and rejects requests without one. It also fails startup if the OS can't apply the configuration, while `Legacy` and `Medium` log the configuration failure and continue. diff --git a/aspnetcore/release-notes/aspnetcore-11/includes/validation-attributes-no-longer-experimental-preview-7.md b/aspnetcore/release-notes/aspnetcore-11/includes/validation-attributes-no-longer-experimental-preview-7.md new file mode 100644 index 000000000000..733eb1fb93f4 --- /dev/null +++ b/aspnetcore/release-notes/aspnetcore-11/includes/validation-attributes-no-longer-experimental-preview-7.md @@ -0,0 +1,3 @@ +### Validation attributes are no longer experimental + +`ValidatableTypeAttribute` and `SkipValidationAttribute` are no longer marked experimental. If you suppressed `ASP0029` to use either attribute, remove the suppression. diff --git a/aspnetcore/release-notes/aspnetcore-11/includes/validation-localization-preview-7.md b/aspnetcore/release-notes/aspnetcore-11/includes/validation-localization-preview-7.md new file mode 100644 index 000000000000..0001f2a7f7b1 --- /dev/null +++ b/aspnetcore/release-notes/aspnetcore-11/includes/validation-localization-preview-7.md @@ -0,0 +1,43 @@ +### Validation localization is built in + +`Microsoft.Extensions.Validation` localizes validation messages and display names without a separate package. Localization activates automatically as soon as an `IStringLocalizerFactory` is registered, and the lookup is emitted by the validation source generator into your assembly. + + + +```csharp +builder.Services.AddLocalization(); +builder.Services.AddValidation(); +``` + +```csharp +[ValidatableType] +public class CustomerModel +{ + [Display(Name = "CustomerName")] // resource key for the display name + [Required(ErrorMessage = "NameRequired")] // resource key for the message + public string? Name { get; set; } +} +``` + +Keys resolve against the model's own resources, and a miss falls back to the attribute's built-in message. Use `ValidationOptions.LocalizerProvider` to resolve keys from a shared resource file instead: + +```csharp +builder.Services.AddValidation(options => +{ + options.LocalizerProvider = (_, factory) => factory.Create(typeof(ValidationMessages)); +}); +``` + +Attributes that already localize themselves (`ErrorMessageResourceType`, `[Display(ResourceType = …)]`) bypass the pipeline entirely. A custom attribute that needs to substitute its own values into the message template can implement `IValidationMessageFormatter`: + +```csharp +public sealed class DivisibleByAttribute : ValidationAttribute, IValidationMessageFormatter +{ + public int Divisor { get; init; } + + public string FormatMessage(CultureInfo culture, string template, string displayName) + => string.Format(culture, template, displayName, Divisor); // {0} = name, {1} = divisor +} +``` + +The same localization rules apply to validation for minimal APIs and Blazor, so a message localizes identically wherever the model is used. From c0389ea82674c893c0b333c1a19144f6d9b90c24 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 12 Aug 2026 15:58:23 +0000 Subject: [PATCH 3/4] Address review: clearer OpenAPI SSE heading and validation localization intro Co-authored-by: wadepickett <10985336+wadepickett@users.noreply.github.com> --- .../includes/openapi-server-sent-events-preview-7.md | 2 +- .../aspnetcore-11/includes/validation-localization-preview-7.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/aspnetcore/release-notes/aspnetcore-11/includes/openapi-server-sent-events-preview-7.md b/aspnetcore/release-notes/aspnetcore-11/includes/openapi-server-sent-events-preview-7.md index 1f3fdded49fb..3ade6ca3fec6 100644 --- a/aspnetcore/release-notes/aspnetcore-11/includes/openapi-server-sent-events-preview-7.md +++ b/aspnetcore/release-notes/aspnetcore-11/includes/openapi-server-sent-events-preview-7.md @@ -1,4 +1,4 @@ -### OpenAPI Server-Sent Events in OpenAPI 3.2 +### Server-Sent Events support in OpenAPI 3.2 Endpoints that return `SseItem` are described in the generated OpenAPI document with the OpenAPI 3.2 `itemSchema` shape for `text/event-stream` responses. The `itemSchema` describes a stream's per-event payload shape instead of falling back to a plain `string` schema. diff --git a/aspnetcore/release-notes/aspnetcore-11/includes/validation-localization-preview-7.md b/aspnetcore/release-notes/aspnetcore-11/includes/validation-localization-preview-7.md index 0001f2a7f7b1..a9390f95020a 100644 --- a/aspnetcore/release-notes/aspnetcore-11/includes/validation-localization-preview-7.md +++ b/aspnetcore/release-notes/aspnetcore-11/includes/validation-localization-preview-7.md @@ -1,6 +1,6 @@ ### Validation localization is built in -`Microsoft.Extensions.Validation` localizes validation messages and display names without a separate package. Localization activates automatically as soon as an `IStringLocalizerFactory` is registered, and the lookup is emitted by the validation source generator into your assembly. +`Microsoft.Extensions.Validation` localizes validation messages and display names without a separate package. Calling `AddLocalization` to register an `IStringLocalizerFactory`, followed by `AddValidation`, activates localization automatically, and the lookup is emitted by the validation source generator into your assembly. From 68043c06592c48001c3225d5d3bb572456a16708 Mon Sep 17 00:00:00 2001 From: Wade Pickett Date: Wed, 12 Aug 2026 09:16:31 -0700 Subject: [PATCH 4/4] Apply suggestions from code review Co-authored-by: Wade Pickett --- .../includes/signalr-auth-refresh-redirects-preview-7.md | 2 +- .../includes/validation-localization-preview-7.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/aspnetcore/release-notes/aspnetcore-11/includes/signalr-auth-refresh-redirects-preview-7.md b/aspnetcore/release-notes/aspnetcore-11/includes/signalr-auth-refresh-redirects-preview-7.md index 607aed10e44d..05d68ef2c41b 100644 --- a/aspnetcore/release-notes/aspnetcore-11/includes/signalr-auth-refresh-redirects-preview-7.md +++ b/aspnetcore/release-notes/aspnetcore-11/includes/signalr-auth-refresh-redirects-preview-7.md @@ -1,6 +1,6 @@ ### SignalR .NET client supports authentication refresh after redirects -The SignalR .NET client extends [SignalR authentication refresh](#signalr-authentication-refresh) so it works when negotiate redirects to another server, contributed by [@MoChilia](https://github.com/MoChilia). This client change enables support for redirecting servers such as Azure SignalR Service, but Azure SignalR Service hasn't enabled the feature yet. +The SignalR .NET client extends [SignalR authentication refresh](#signalr-authentication-refresh) so it works when negotiate redirects to another server, contributed by [@MoChilia](https://github.com/MoChilia). This client change enables support for redirecting servers such as Azure SignalR Service, which hasn't enabled the feature yet. The client preserves the app-token provider across the redirect, adopts a refreshed transport token from the response, and retains `tokenLifetimeSeconds` so automatic refresh remains scheduled after the original token expires. diff --git a/aspnetcore/release-notes/aspnetcore-11/includes/validation-localization-preview-7.md b/aspnetcore/release-notes/aspnetcore-11/includes/validation-localization-preview-7.md index a9390f95020a..97acd31ef834 100644 --- a/aspnetcore/release-notes/aspnetcore-11/includes/validation-localization-preview-7.md +++ b/aspnetcore/release-notes/aspnetcore-11/includes/validation-localization-preview-7.md @@ -1,6 +1,6 @@ ### Validation localization is built in -`Microsoft.Extensions.Validation` localizes validation messages and display names without a separate package. Calling `AddLocalization` to register an `IStringLocalizerFactory`, followed by `AddValidation`, activates localization automatically, and the lookup is emitted by the validation source generator into your assembly. +`Microsoft.Extensions.Validation` localizes validation messages and display names without a separate package. Calling `AddLocalization` to register an `IStringLocalizerFactory`, followed by `AddValidation`, activates localization automatically. The validation source generator emits the localization lookup into your assembly. @@ -28,7 +28,7 @@ builder.Services.AddValidation(options => }); ``` -Attributes that already localize themselves (`ErrorMessageResourceType`, `[Display(ResourceType = …)]`) bypass the pipeline entirely. A custom attribute that needs to substitute its own values into the message template can implement `IValidationMessageFormatter`: +Attributes that already localize themselves (`ErrorMessageResourceType`, `[Display(ResourceType = ...)]`) bypass the pipeline entirely. A custom attribute that needs to substitute its own values into the message template can implement `IValidationMessageFormatter`: ```csharp public sealed class DivisibleByAttribute : ValidationAttribute, IValidationMessageFormatter