Skip to content

Commit 0736d21

Browse files
Make requested change
1 parent f8338e2 commit 0736d21

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

docs/v5.0.0 Breaking Change.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# v5.0.0 Breaking Change
22
This release provides an update for the RedisSessionStateProvider nuget package. As a BREAKING CHANGE, the underlying serialization method has changed. SessionStateItemCollection objects are now treated as an atomic unit. The ability to add custom serialization has been removed. These changes were made for necessary security improvements.
33

4-
The BinaryFormatter type is insecure and can't be made secure [1]. The previous ASP.NET Session State Provider implementation for Redis relies on BinaryFormatter to serialize session state objects. No drop-in replacement exists for BinaryFormatter which does not require defining a contract for the serialized objects [2]. However, the SessionStateItemCollection type offers a serialization method based on BinaryWriter [3]. BinaryWriter serializes primitive types instead of generic objects [4].
4+
The BinaryFormatter type is insecure and can't be made secure [1]. The previous ASP.NET Session State Provider implementation for Redis relied on BinaryFormatter to serialize session state objects. No drop-in replacement exists for BinaryFormatter which does not require defining a contract for the serialized objects [2]. However, the SessionStateItemCollection type offers a serialization method based on BinaryWriter [3]. BinaryWriter serializes primitive types instead of generic objects [4].
55

66
[1] https://docs.microsoft.com/dotnet/standard/serialization/binaryformatter-security-guide
77

0 commit comments

Comments
 (0)