---
title: SAIF.NetCore.LegacyAuth dependencies
summary: Internal and external dependencies for this library.
status: draft
owner: Framework
last_reviewed: 2026-10-02
library: SAIF.NetCore.LegacyAuth
reference_type: package
---

# SAIF.NetCore.LegacyAuth dependencies

SAIF.NetCore.LegacyAuth takes a single internal NuGet dependency on SAIF.NetCore.ServiceContracts (for an unused `IOidcSettings` injection and a transitive ASP.NET Core shared framework reference), a direct native-OS dependency on the Windows Data Protection API, and makes no outbound API calls of its own.

## Internal dependencies

| Dependency | Reference Type | Usage |
| --- | --- | --- |
| [SAIF.NetCore.ServiceContracts](../saif-netcore-servicecontracts/overview.md) | NuGet Package (same-repo) | `IOidcSettings` is constructor-injected into `LegacyAuthCookieService` but never read (verified — the field is stored and never referenced elsewhere in the type); the package also transitively supplies `Microsoft.AspNetCore.App` (`FrameworkReference`), which provides `IHttpContextAccessor`, `HttpContext`, `IHeaderDictionary`, `SetCookieHeaderValue`, `HeaderNames`, and `StringValues` |

## External dependencies

| Dependency | Version | Usage |
| --- | --- | --- |
| Windows Data Protection API (`crypt32.dll`) | OS-provided (not a NuGet package) | `CryptProtectData`/`CryptUnprotectData` P/Invoke calls in `DPAPI`, hard-coded to `c:\windows\system32\crypt32.dll`; this is a native OS coupling, not a package reference |

There are no third-party (non-Microsoft, non-SAIF) NuGet packages. All other types used (`IHttpContextAccessor`, `HttpContext`, `SetCookieHeaderValue`, `HeaderNames`, `StringValues`, `Marshal`, `Win32Exception`, `Encoding`) come from the BCL and the transitive `Microsoft.AspNetCore.App` shared framework.

## Dependency risks and notes
- This library makes no outbound API calls of its own: it has no `HttpClient`/`IHttpJsonClient`/service-proxy dependency of any kind. Its only outbound calls are to the native Windows DPAPI (`crypt32!CryptProtectData`) and to ASP.NET Core's own response-header and cookie APIs, confirmed by a full read of all three compiled source files.
- The DPAPI dependency is Windows-only and hard-coded to a fixed DLL path with no `[SupportedOSPlatform("windows")]` annotation, even though the package targets cross-platform `net8.0;net10.0` TFMs; the first encrypt call's native invocation throws `DllNotFoundException` on any other OS or non-default Windows installation, but that exception is caught and rewrapped as a generic `System.Exception("DPAPI was unable to encrypt data.")` with the `DllNotFoundException` as its inner cause rather than surfacing directly.
- `IOidcSettings` is an unused dependency: any consumer must still register an implementation for DI construction to succeed, even though no member of it is ever read.
- There is no consumer of this package anywhere in this repository; downstream consumer applications and their hosting OS are not verifiable from the repo**.
- The encrypted cookie binds decryption to the issuing machine (DPAPI machine-key scope) and to the client's remote IP address as entropy, so the legacy reader must run on the same host and observe the same IP — a deployment-topology risk behind proxies or load balancers that is unknown from this repository**.
- The issued cookie omits `Secure` and `SameSite` attributes; see the library's security and authorization findings for the full risk discussion.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [API reference](api/index.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts. Statements marked with `**` could not be confirmed; treat
> as unknown until verified.

## Sources
- `src/SAIF.NetCore.LegacyAuth/src/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth.csproj`
- `src/SAIF.NetCore.LegacyAuth/src/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth/LegacyAuthCookieService.cs`
- `src/SAIF.NetCore.LegacyAuth/src/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth/DPAPI.cs`
- `src/SAIF.NetCore.ServiceContracts/SAIF.NetCore.ServiceContracts/SAIF.NetCore.ServiceContracts/SAIF.NetCore.ServiceContracts.csproj`