Skip to content

SAIF.NetCore.LegacyAuth dependencies

SAIF.NetCore.LegacyAuth takes a single internal NuGet dependency on SAIF.NetCore.ServiceContracts (for an unused IOidcSettings injection and a transitive ASP.NET Core shared framework reference), a direct native-OS dependency on the Windows Data Protection API, and makes no outbound API calls of its own.

Internal dependencies

Dependency Reference Type Usage
SAIF.NetCore.ServiceContracts NuGet Package (same-repo) IOidcSettings is constructor-injected into LegacyAuthCookieService but never read (verified — the field is stored and never referenced elsewhere in the type); the package also transitively supplies Microsoft.AspNetCore.App (FrameworkReference), which provides IHttpContextAccessor, HttpContext, IHeaderDictionary, SetCookieHeaderValue, HeaderNames, and StringValues

External dependencies

Dependency Version Usage
Windows Data Protection API (crypt32.dll) OS-provided (not a NuGet package) CryptProtectData/CryptUnprotectData P/Invoke calls in DPAPI, hard-coded to c:\windows\system32\crypt32.dll; this is a native OS coupling, not a package reference

There are no third-party (non-Microsoft, non-SAIF) NuGet packages. All other types used (IHttpContextAccessor, HttpContext, SetCookieHeaderValue, HeaderNames, StringValues, Marshal, Win32Exception, Encoding) come from the BCL and the transitive Microsoft.AspNetCore.App shared framework.

Dependency risks and notes

  • This library makes no outbound API calls of its own: it has no HttpClient/IHttpJsonClient/service-proxy dependency of any kind. Its only outbound calls are to the native Windows DPAPI (crypt32!CryptProtectData) and to ASP.NET Core's own response-header and cookie APIs, confirmed by a full read of all three compiled source files.
  • The DPAPI dependency is Windows-only and hard-coded to a fixed DLL path with no [SupportedOSPlatform("windows")] annotation, even though the package targets cross-platform net8.0;net10.0 TFMs; the first encrypt call's native invocation throws DllNotFoundException on any other OS or non-default Windows installation, but that exception is caught and rewrapped as a generic System.Exception("DPAPI was unable to encrypt data.") with the DllNotFoundException as its inner cause rather than surfacing directly.
  • IOidcSettings is an unused dependency: any consumer must still register an implementation for DI construction to succeed, even though no member of it is ever read.
  • There is no consumer of this package anywhere in this repository; downstream consumer applications and their hosting OS are not verifiable from the repo**.
  • The encrypted cookie binds decryption to the issuing machine (DPAPI machine-key scope) and to the client's remote IP address as entropy, so the legacy reader must run on the same host and observe the same IP — a deployment-topology risk behind proxies or load balancers that is unknown from this repository**.
  • The issued cookie omits Secure and SameSite attributes; see the library's security and authorization findings for the full risk discussion.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

  • src/SAIF.NetCore.LegacyAuth/src/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth.csproj
  • src/SAIF.NetCore.LegacyAuth/src/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth/LegacyAuthCookieService.cs
  • src/SAIF.NetCore.LegacyAuth/src/SAIF.NetCore.LegacyAuth/SAIF.NetCore.LegacyAuth/DPAPI.cs
  • src/SAIF.NetCore.ServiceContracts/SAIF.NetCore.ServiceContracts/SAIF.NetCore.ServiceContracts/SAIF.NetCore.ServiceContracts.csproj