Added
ASP.NET Session Encryption for Multi-Server Deployments
25 days ago by Jim Verducci
📣 Wristband ASP.NET Auth SDK 4.1.0 Release 🎉
Release 4.1.0
Session Encryption for Multi-Server Deployments
Adds zero-infrastructure session encryption via AddInMemoryKeyDataProtection(), enabling cookie-based sessions to work across multi-server and containerized deployments without requiring Redis or persistent storage.
What's New
- In-memory key data protection - Derives encryption keys from shared secrets using HKDF-SHA256 + AES-256-GCM
- Zero-downtime secret rotation - Support for up to 3 secrets with automatic re-encryption
- OWASP compliant - Meets cryptographic storage best practices for session encryption
- Cross-platform compatible - Uses same format as Wristband's TypeScript session SDK
Breaking Changes
None - this is a new optional feature. Existing deployments continue working unchanged.
Documentation
- Updated README with setup guide and advanced configuration
- Added
Session Encryption Configurationsection under Session Management - Added
Session Encryption with Persistent Key Storagesection under Advanced Configuration