<divclass="NOTE"><h5>Note</h5><p>In OpenIddict 3.0, the ability to revoke a token is not tied to the token format and doesn't require enabling reference tokens:
regular JWT or ASP.NET Core Data Protection tokens can be revoked as long as token storage is not explicitly disabled in the server options.</p>
<p>OpenIddict 3.0 implements the <ahref="https://tools.ietf.org/html/rfc7519">JSON Web Token</a>, <ahref="https://tools.ietf.org/html/rfc7515">JSON Web Signature</a>
and <ahref="https://tools.ietf.org/html/rfc7516">JSON Web Encryption</a> standards and relies on the
<ahref="https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/">Azure Active Directory IdentityModel Extensions for .NET library</a>
<p>To protect against token substitution and confused deputy attacks, <strong>OpenIddict 3.0 uses the standard <code>typ</code> JWT header to convey the actual token type</strong>.
This mechanism replaces the private <code>token_usage</code> claim used for the same purpose in previous versions of OpenIddict.</p>
<p>As required by the <ahref="https://datatracker.ietf.org/doc/html/rfc9068">JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens specification</a>,
<strong>access tokens produced by OpenIddict 3.0 are always issued with a <code>"typ": "at+jwt"</code> header</strong> while identity tokens still use <code>"typ": "JWT"</code> for backward compatibility.
Other types of tokens – only accepted by OpenIddict's own endpoints – use private token types prefixed by <code>oi_</code>.</p>
<p>By default, <strong>OpenIddict enforces encryption for all the token types it supports</strong>. While this enforcement cannot be disabled for authorization codes,
refresh tokens and device codes for security reasons, it can be relaxed for access tokens when integration with third-party APIs/resource servers is desired.
Access token encryption can also be disabled if the resource servers receiving the access tokens don't fully support JSON Web Encryption.</p>
</code></pre><h2id="aspnet-core-data-protection">ASP.NET Core Data Protection</h2>
<p>OpenIddict 3.0 can also be configured to use <ahref="https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/introduction">ASP.NET Core Data Protection</a> to create
Data Protection tokens instead of JWT tokens. ASP.NET Core Data Protection uses its own key ring to encrypt and protect tokens against tampering and is supported for all
types of tokens, except identity tokens, that are always JWT tokens.</p>
<p>Unlike JWTs, ASP.NET Core Data Protection tokens only support symmetric encryption and rely on a binary format developed by the ASP.NET team rather than on a standard like JWT.
While this prevents using such tokens in scenarios where interoperability is needed, opting for ASP.NET Core Data Protection rather than JWT has actually a few advantages:</p>
<ul>
<li>ASP.NET Core Data Protection tokens don't use a JSON representation and therefore are generally a bit shorter.</li>
<li>ASP.NET Core Data Protection has been designed to achieve high throughput as it's natively used by ASP.NET Core for authentication cookies,
<divclass="WARNING"><h5>Warning</h5><p>Despite its name, ASP.NET Core Data Protection is not tied to ASP.NET Core and can be used in any .NET Standard 2.0-compatible
application, including legacy ASP.NET 4.6.1 (and higher) applications using <code>Microsoft.Owin</code>.</p>
<p>To enable ASP.NET Core Data Protection support in the OpenIddict OWIN server and validation hosts, you need to
manually reference the <code>OpenIddict.Server.DataProtection</code> and <code>OpenIddict.Validation.DataProtection</code> packages.</p>
</div>
<h3id="switching-to-data-protection-tokens">Switching to Data Protection tokens</h3>
<p>ASP.NET Core Data Protection support is provided by the <code>OpenIddict.Server.DataProtection</code> and <code>OpenIddict.Validation.DataProtection</code> packages.
These packages are referenced by the <code>OpenIddict.AspNetCore</code> metapackage and therefore don't have to be referenced explicitly.</p>
<p>To enable ASP.NET Core Data Protection support, call <code>options.UseDataProtection()</code> in <strong>both the server and validation options</strong>:</p>
</code></pre><divclass="NOTE"><h5>Note</h5><p>Switching to ASP.NET Core Data Protection tokens doesn't prevent JWT tokens issued before Data Protection support was enabled from being validated:
existing tokens can still be used alongside newly issued ASP.NET Core Data Protection tokens until they expire. When sending a refresh token request containing
a JWT refresh token, the application will receive an ASP.NET Core Data Protection refresh token and the previous one will be automatically marked as redeemed.</p>
<p>By default, enabling ASP.NET Core Data Protection support will automatically switch the token format from JWT to Data Protection for all types of tokens, except JWT tokens.
The OpenIddict/Data Protection integration can be configured to prefer JWT when creating new tokens, <strong>which can be useful when using the ASP.NET Core Data Protection
</code></pre><divclass="WARNING"><h5>Warning</h5><p>When the authorization and API/resource servers are not part of the same application, ASP.NET Core Data Protection MUST be configured to use
generated by an authorization server located in another project.</p>
<p>For more information, read <ahref="https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/configuration/overview">Configure ASP.NET Core Data Protection</a>.</p>
