ProAuth Release Notes

Appearance

ProAuth 2.2.2 ​

This maintenance-focused release delivers upstream security patch updates and improves the resilience of token state storage in multi-instance deployments. It also introduces optional configuration knobs to tune token lifecycle behavior for Redis and SQL-backed token stores without changing defaults.

Security ​

Security

Security Patch Updates (No Functional Changes) ​

Internal components (NuGet packages, the .NET SDK, and runtime/base images) have been updated to the latest patch/minor versions to address upstream security advisories. This reduces security risk by incorporating upstream fixes as part of routine platform maintenance. (#2869)

Maintenance Release

No major-version upgrades were introduced and no functional product changes are expected. No customer action is required. (#2869)

Core ​

Core

Token State Store Reliability Improvements (Redis) ​

For multi-instance deployments using the Redis/state-store token backend, token lifecycle handling is now more predictable under load, and administrators can optionally tune related behavior via configuration. (#2868)

Infrastructure ​

Infrastructure

Token Lifecycle and Pruning Tuning (Helm / AppSettings) ​

Three new optional Helm chart values are available under appsettings.baseservicesettings to tune token retention and pruning. Defaults preserve existing behavior unless overridden. (#2868)

KeyBackendDefaultDescription
tokenstatestorettlafterrevocationinsecondsRedis120How long (in seconds) a revoked token remains in Redis. Set to 0 for immediate deletion.
usertokensmaxconcurrencyretriesRedis8Maximum number of optimistic-concurrency retry attempts for per-user token index updates.
tokenstorepruneintervalinminutesDatabase60How often (in minutes) the background job prunes expired tokens from the SQL database.

Docs Links:

Platform Stability ​

  • Revoked token cleanup: Corrected the TTL metadata for revoked tokens in the Redis state store so they are retained only for a short, configurable window (default: 120 seconds) and then removed automatically. (#2868)
  • Concurrent token index consistency: Improved per-user token index updates in Redis using optimistic concurrency with automatic retries to prevent token references from being silently lost under concurrent, multi-instance load. (#2868)
  • Expired token pruning control: Added an optional scheduling control for the SQL token-store pruning job to better align background cleanup with operational needs (default: every 60 minutes). (#2868)