chore: Clean up codebase

README.md

@@ -251,6 +251,18 @@ builder.Services.AddAuth0ApiAuthentication(
 
 For detailed configuration options, caching strategies, security requirements, and more examples, see [EXAMPLES.md - Multiple Custom Domains](./EXAMPLES.md#multiple-custom-domains).
 
+### Security requirements
+
+When configuring the `DomainsResolver`, you are responsible for ensuring that all resolved domains are trusted. Mis-configuring the domain resolver is a critical security risk that can lead to authentication bypass on the relying party (RP) or expose the application to Server-Side Request Forgery (SSRF).
+
+**Single tenant limitation:**
+The `DomainsResolver` is intended solely for multiple custom domains belonging to the same Auth0 tenant. It is not a supported mechanism for connecting multiple Auth0 tenants to a single application.
+
+**Secure proxy requirement:**
+When using MCD, your application must be deployed behind a secure edge or reverse proxy (e.g., Cloudflare, Nginx, or AWS ALB). The proxy must be configured to sanitize and overwrite `Host` and `X-Forwarded-Host` headers before they reach your application.
+
+Without a trusted proxy layer to validate these headers, an attacker can manipulate the domain resolution process. This can result in malicious redirects, where users are sent to unauthorized or fraudulent endpoints during the authentication flows.
+
 ### Using Full JWT Bearer Options
 
 Since this library provides **complete access to JWT Bearer configuration**, you can use any standard JWT Bearer option via the `configureJwtBearer` parameter:
@@ -295,18 +307,6 @@ builder.Services.AddAuth0ApiAuthentication(
 > - Error handling and logging
 > - And much more!
 
-### Security requirements
-
-When configuring the `DomainsResolver`, you are responsible for ensuring that all resolved domains are trusted. Mis-configuring the domain resolver is a critical security risk that can lead to authentication bypass on the relying party (RP) or expose the application to Server-Side Request Forgery (SSRF).
-
-**Single tenant limitation:**
-The `DomainsResolver` is intended solely for multiple custom domains belonging to the same Auth0 tenant. It is not a supported mechanism for connecting multiple Auth0 tenants to a single application.
-
-**Secure proxy requirement:**
-When using MCD, your application must be deployed behind a secure edge or reverse proxy (e.g., Cloudflare, Nginx, or AWS ALB). The proxy must be configured to sanitize and overwrite `Host` and `X-Forwarded-Host` headers before they reach your application.
-
-Without a trusted proxy layer to validate these headers, an attacker can manipulate the domain resolution process. This can result in malicious redirects, where users are sent to unauthorized or fraudulent endpoints during the authentication flows.
-
 ## Examples
 
 For comprehensive, copy-pastable code examples covering various scenarios, see **[EXAMPLES.md](./EXAMPLES.md)**:
@@ -400,6 +400,10 @@ If you have questions or need help:
 - 💬 Visit the [Auth0 Community](https://community.auth0.com/)
 - 🐛 Report issues on [GitHub Issues](https://github.com/auth0/aspnetcore-api/issues)
 
+### Vulnerability Reporting
+
+Please do not report security vulnerabilities on the public GitHub issue tracker. The [Responsible Disclosure Program](https://auth0.com/responsible-disclosure-policy) details the procedure for disclosing security issues.
+
 ## License
 Copyright 2025 Okta, Inc.
 

src/Auth0.AspNetCore.Authentication.Api/Auth0.AspNetCore.Authentication.Api.csproj

@@ -30,7 +30,8 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.27" Condition="'$(TargetFramework)' == 'net8.0'" />
     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.3" Condition="'$(TargetFramework)' == 'net10.0'" />
-    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.8" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.3" Condition="'$(TargetFramework)' == 'net8.0'" />
+    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.8" Condition="'$(TargetFramework)' == 'net10.0'" />
     <PackageReference Include="Microsoft.SourceLink.GitHub" Version="10.0.300" PrivateAssets="All" />
   </ItemGroup>
 

src/Auth0.AspNetCore.Authentication.Api/DPoP/EventHandlers/ChallengeHandler.cs

@@ -12,7 +12,7 @@ namespace Auth0.AspNetCore.Authentication.Api.DPoP.EventHandlers;
 /// Handles JWT Bearer challenge events for DPoP authentication scenarios.
 /// Generates appropriate WWW-Authenticate headers based on DPoP mode and error conditions.
 /// </summary>
-public class ChallengeHandler : DPoPEventHandlerBase, IDPoPEventHandler<JwtBearerChallengeContext>
+internal class ChallengeHandler : DPoPEventHandlerBase, IDPoPEventHandler<JwtBearerChallengeContext>
 {
     private static readonly string DefaultDPoPHeader = $"DPoP {Auth0Constants.DPoP.Error.DefaultDPoPAlgs}";
     private readonly ILogger<ChallengeHandler> _logger;

src/Auth0.AspNetCore.Authentication.Api/DPoP/EventHandlers/DPoPEventHandlerBase.cs

@@ -10,7 +10,7 @@ namespace Auth0.AspNetCore.Authentication.Api.DPoP.EventHandlers;
 ///     Base class for DPoP event handlers.
 ///     Provides core methods for extracting and validating DPoP-bound access tokens and headers.
 /// </summary>
-public abstract class DPoPEventHandlerBase
+internal abstract class DPoPEventHandlerBase
 {
     /// <summary>
     ///     Extracts the token portion from a DPoP Authorization header by removing the scheme prefix.

src/Auth0.AspNetCore.Authentication.Api/DPoP/EventHandlers/IDPoPEventHandler.cs

@@ -2,7 +2,7 @@
 
 namespace Auth0.AspNetCore.Authentication.Api.DPoP.EventHandlers;
 
-public interface IDPoPEventHandler<T>
+internal interface IDPoPEventHandler<T>
 {
     /// <summary>
     ///     Handles the event with the provided context.

src/Auth0.AspNetCore.Authentication.Api/DPoP/EventHandlers/MessageReceivedHandler.cs

@@ -6,7 +6,7 @@
 
 namespace Auth0.AspNetCore.Authentication.Api.DPoP.EventHandlers;
 
-public class MessageReceivedHandler : DPoPEventHandlerBase, IDPoPEventHandler<MessageReceivedContext>
+internal class MessageReceivedHandler : DPoPEventHandlerBase, IDPoPEventHandler<MessageReceivedContext>
 {
     private readonly ILogger<MessageReceivedHandler> _logger;
 

src/Auth0.AspNetCore.Authentication.Api/DPoP/EventHandlers/TokenValidationHandler.cs

@@ -8,7 +8,7 @@
 
 namespace Auth0.AspNetCore.Authentication.Api.DPoP.EventHandlers;
 
-public class TokenValidationHandler : DPoPEventHandlerBase, IDPoPEventHandler<TokenValidatedContext>
+internal class TokenValidationHandler : DPoPEventHandlerBase, IDPoPEventHandler<TokenValidatedContext>
 {
     private readonly IDPoPProofValidationService _validationService;
     private readonly ILogger<TokenValidationHandler> _logger;

src/Auth0.AspNetCore.Authentication.Api/Utils.cs

@@ -6,7 +6,7 @@
 
 namespace Auth0.AspNetCore.Authentication.Api;
 
-public abstract class Utils
+internal abstract class Utils
 {
     /// <summary>
     ///     Creates a Base64-encoded JSON string containing the SDK agent name and version.