openiddict · kevinchalet · Jul 30, 2026 · Jul 30, 2026
diff --git a/.editorconfig b/.editorconfig
@@ -95,10 +95,22 @@ csharp_using_directive_placement = outside_namespace
 
 [*.{cs,vb}]
 dotnet_code_quality_unused_parameters = all
-dotnet_diagnostic.CA1510.severity = suggestion
+dotnet_diagnostic.CA1510.severity = none
+dotnet_diagnostic.CA1873.severity = none
 dotnet_diagnostic.CA2254.severity = none
 dotnet_diagnostic.IDE0002.severity = none
+dotnet_diagnostic.IDE0042.severity = none
 dotnet_diagnostic.IDE0305.severity = none
+dotnet_diagnostic.MA0003.severity = none
+dotnet_diagnostic.MA0004.severity = none
+dotnet_diagnostic.MA0007.severity = none
+dotnet_diagnostic.MA0016.severity = none
+dotnet_diagnostic.MA0029.severity = none
+dotnet_diagnostic.MA0048.severity = none
+dotnet_diagnostic.MA0051.severity = none
+dotnet_diagnostic.MA0056.severity = none
+dotnet_diagnostic.MA0084.severity = none
+dotnet_diagnostic.MA0100.severity = none
 dotnet_naming_rule.interface_should_be_begins_with_i.severity = suggestion
 dotnet_naming_rule.interface_should_be_begins_with_i.style = begins_with_i
 dotnet_naming_rule.interface_should_be_begins_with_i.symbols = interface

diff --git a/Directory.Packages.props b/Directory.Packages.props
@@ -4,17 +4,14 @@
     Note: to cover as many platforms as possible and reduce the number of package references,
     OpenIddict extensively uses multi-targeting and per-framework package references. As such,
     package versions must be carefully chosen to ensure they are consistent and compatible with
-    the TFMs supported by OpenIddict (e.g for .NET 10, only Microsoft.AspNetCore.* packages within
+    the TFMs supported by OpenIddict (e.g for .NET 10, only Microsoft.Extensions.* packages within
     the [10.0.0,11.0.0) range are allowed). Special care must also be taken when selecting versions
     to ensure that transitive references also respect the same constraints (e.g for the .NET 10 TFM,
     a package must only depend on Microsoft.Extensions.* packages within the [10.0.0,11.0.0) range).
   -->
 
-  <!--
-    Note: OpenIddict uses Meziantou.Polyfill to dynamically generate polyfills for types that are not available
-    on some of the targeted TFMs (e.g Index, Range or nullable attributes on .NET Framework/.NET Standard).
-  -->
   <ItemGroup Label="Package versions for all targets">
+    <GlobalPackageReference Include="Meziantou.Analyzer"                            Version="3.0.136"         />
     <GlobalPackageReference Include="Meziantou.Polyfill"                            Version="1.0.158"         />
   </ItemGroup>
 

diff --git a/gen/OpenIddict.Client.WebIntegration.Generators/OpenIddictClientWebIntegrationGenerator.cs b/gen/OpenIddict.Client.WebIntegration.Generators/OpenIddictClientWebIntegrationGenerator.cs
@@ -897,7 +897,7 @@ public static class ProviderTypes
                                 Name = (string) constant.Attribute("Name"),
                                 Value = (string) constant.Attribute("Value")
                             })
-                            .GroupBy(static constant => constant.Class)
+                            .GroupBy(static constant => constant.Class, StringComparer.Ordinal)
                             .ToList(),
                     })
                     .ToList()
@@ -1600,7 +1600,7 @@ public sealed class {{ provider.name }}
 
         static TemplateContext CreateTemplateContext(object model)
         {
-            var context = new TemplateContext
+            var context = new TemplateContext(StringComparer.OrdinalIgnoreCase)
             {
                 LimitToString = 128 * 1024 * 1024,
                 LoopLimit = 100_000

diff --git a/sandbox/OpenIddict.Sandbox.AspNet.Client/Controllers/AuthenticationController.cs b/sandbox/OpenIddict.Sandbox.AspNet.Client/Controllers/AuthenticationController.cs
@@ -31,7 +31,7 @@ public async Task<ActionResult> LogIn(string provider, string returnUrl)
         // the user is directly redirected to GitHub (in this case, no login page is shown).
         if (string.Equals(provider, "Local+GitHub", StringComparison.Ordinal))
         {
-            var properties = new AuthenticationProperties(new Dictionary<string, string?>
+            var properties = new AuthenticationProperties(new Dictionary<string, string?>(StringComparer.Ordinal)
             {
                 // Note: when only one client is registered in the client options,
                 // specifying the issuer URI or the provider name is not required.
@@ -61,7 +61,7 @@ public async Task<ActionResult> LogIn(string provider, string returnUrl)
                 return new HttpStatusCodeResult(400);
             }
 
-            var properties = new AuthenticationProperties(new Dictionary<string, string?>
+            var properties = new AuthenticationProperties(new Dictionary<string, string?>(StringComparer.Ordinal)
             {
                 // Note: when only one client is registered in the client options,
                 // specifying the issuer URI or the provider name is not required.
@@ -100,7 +100,7 @@ public async Task<ActionResult> LogOut(string returnUrl)
         if (identity.FindFirst(Claims.Private.RegistrationId)?.Value is string identifier &&
             await _service.GetServerConfigurationByRegistrationIdAsync(identifier) is { EndSessionEndpoint: Uri })
         {
-            var properties = new AuthenticationProperties(new Dictionary<string, string?>
+            var properties = new AuthenticationProperties(new Dictionary<string, string?>(StringComparer.Ordinal)
             {
                 [OpenIddictClientOwinConstants.Properties.RegistrationId] = identifier,
 
@@ -195,7 +195,7 @@ or Claims.Private.RegistrationId or Claims.Private.ProviderName
                 OpenIddictClientOwinConstants.Tokens.BackchannelAccessToken   or
                 OpenIddictClientOwinConstants.Tokens.BackchannelIdentityToken or
                 OpenIddictClientOwinConstants.Tokens.RefreshToken)
-            .ToDictionary(pair => pair.Key, pair => pair.Value))
+            .ToDictionary(pair => pair.Key, pair => pair.Value, StringComparer.Ordinal))
         {
             // Set the creation and expiration dates of the ticket to null to decorrelate the lifetime
             // of the resulting authentication cookie from the lifetime of the identity token returned by

diff --git a/sandbox/OpenIddict.Sandbox.AspNet.Server/Controllers/AuthenticationController.cs b/sandbox/OpenIddict.Sandbox.AspNet.Server/Controllers/AuthenticationController.cs
@@ -86,7 +86,7 @@ or Claims.Private.RegistrationId or Claims.Private.ProviderName
                 // If needed, the tokens returned by the authorization server can be stored in the authentication cookie.
                 OpenIddictClientOwinConstants.Tokens.BackchannelAccessToken or
                 OpenIddictClientOwinConstants.Tokens.RefreshToken)
-            .ToDictionary(pair => pair.Key, pair => pair.Value))
+            .ToDictionary(pair => pair.Key, pair => pair.Value, StringComparer.Ordinal))
         {
             // Set the creation and expiration dates of the ticket to null to decorrelate the lifetime
             // of the resulting authentication cookie from the lifetime of the identity token returned by

diff --git a/sandbox/OpenIddict.Sandbox.AspNet.Server/Controllers/AuthorizationController.cs b/sandbox/OpenIddict.Sandbox.AspNet.Server/Controllers/AuthorizationController.cs
@@ -92,7 +92,7 @@ public async Task<ActionResult> Authorize()
                 {
                     context.Authentication.Challenge(
                         authenticationTypes: OpenIddictServerOwinDefaults.AuthenticationType,
-                        properties: new AuthenticationProperties(new Dictionary<string, string?>
+                        properties: new AuthenticationProperties(new Dictionary<string, string?>(StringComparer.Ordinal)
                         {
                             [OpenIddictServerOwinConstants.Properties.Error] = Errors.InvalidRequest,
                             [OpenIddictServerOwinConstants.Properties.ErrorDescription] =
@@ -102,7 +102,7 @@ public async Task<ActionResult> Authorize()
                     return new EmptyResult();
                 }
 
-                var properties = new AuthenticationProperties(new Dictionary<string, string?>
+                var properties = new AuthenticationProperties(new Dictionary<string, string?>(StringComparer.Ordinal)
                 {
                     // Note: when only one client is registered in the client options,
                     // specifying the issuer URI or the provider name is not required.
@@ -154,7 +154,7 @@ public async Task<ActionResult> Authorize()
             case ConsentTypes.External when authorizations.Count is 0:
                 context.Authentication.Challenge(
                     authenticationTypes: OpenIddictServerOwinDefaults.AuthenticationType,
-                    properties: new AuthenticationProperties(new Dictionary<string, string?>
+                    properties: new AuthenticationProperties(new Dictionary<string, string?>(StringComparer.Ordinal)
                     {
                         [OpenIddictServerOwinConstants.Properties.Error] = Errors.ConsentRequired,
                         [OpenIddictServerOwinConstants.Properties.ErrorDescription] =
@@ -231,7 +231,7 @@ public async Task<ActionResult> Authorize()
             case ConsentTypes.Systematic when request.HasPromptValue(PromptValues.None):
                 context.Authentication.Challenge(
                     authenticationTypes: OpenIddictServerOwinDefaults.AuthenticationType,
-                    properties: new AuthenticationProperties(new Dictionary<string, string?>
+                    properties: new AuthenticationProperties(new Dictionary<string, string?>(StringComparer.Ordinal)
                     {
                         [OpenIddictServerOwinConstants.Properties.Error] = Errors.ConsentRequired,
                         [OpenIddictServerOwinConstants.Properties.ErrorDescription] =
@@ -277,7 +277,7 @@ public async Task<ActionResult> Accept()
         {
             context.Authentication.Challenge(
                 authenticationTypes: OpenIddictServerOwinDefaults.AuthenticationType,
-                properties: new AuthenticationProperties(new Dictionary<string, string?>
+                properties: new AuthenticationProperties(new Dictionary<string, string?>(StringComparer.Ordinal)
                 {
                     [OpenIddictServerOwinConstants.Properties.Error] = Errors.LoginRequired,
                     [OpenIddictServerOwinConstants.Properties.ErrorDescription] =
@@ -307,7 +307,7 @@ public async Task<ActionResult> Accept()
         {
             context.Authentication.Challenge(
                 authenticationTypes: OpenIddictServerOwinDefaults.AuthenticationType,
-                properties: new AuthenticationProperties(new Dictionary<string, string?>
+                properties: new AuthenticationProperties(new Dictionary<string, string?>(StringComparer.Ordinal)
                 {
                     [OpenIddictServerOwinConstants.Properties.Error] = Errors.ConsentRequired,
                     [OpenIddictServerOwinConstants.Properties.ErrorDescription] =
@@ -425,7 +425,7 @@ public async Task<ActionResult> Exchange()
             {
                 context.Authentication.Challenge(
                     authenticationTypes: OpenIddictServerOwinDefaults.AuthenticationType,
-                    properties: new AuthenticationProperties(new Dictionary<string, string?>
+                    properties: new AuthenticationProperties(new Dictionary<string, string?>(StringComparer.Ordinal)
                     {
                         [OpenIddictServerOwinConstants.Properties.Error] = Errors.InvalidGrant,
                         [OpenIddictServerOwinConstants.Properties.ErrorDescription] = "The token is no longer valid."
@@ -439,7 +439,7 @@ public async Task<ActionResult> Exchange()
             {
                 context.Authentication.Challenge(
                     authenticationTypes: OpenIddictServerOwinDefaults.AuthenticationType,
-                    properties: new AuthenticationProperties(new Dictionary<string, string?>
+                    properties: new AuthenticationProperties(new Dictionary<string, string?>(StringComparer.Ordinal)
                     {
                         [OpenIddictServerOwinConstants.Properties.Error] = Errors.InvalidGrant,
                         [OpenIddictServerOwinConstants.Properties.ErrorDescription] = "The user is no longer allowed to sign in."

diff --git a/sandbox/OpenIddict.Sandbox.AspNet.Server/Controllers/ManageController.cs b/sandbox/OpenIddict.Sandbox.AspNet.Server/Controllers/ManageController.cs
@@ -289,7 +289,7 @@ public async Task<ActionResult> ManageLogins(ManageMessageId? message)
             return View("Error");
         }
         var userLogins = await UserManager.GetLoginsAsync(User.Identity.GetUserId());
-        var otherLogins = AuthenticationManager.GetExternalAuthenticationTypes().Where(auth => userLogins.All(ul => auth.AuthenticationType != ul.LoginProvider)).ToList();
+        var otherLogins = AuthenticationManager.GetExternalAuthenticationTypes().Where(auth => userLogins.All(ul => !string.Equals(auth.AuthenticationType, ul.LoginProvider, System.StringComparison.Ordinal))).ToList();
         ViewBag.ShowRemoveButton = user.PasswordHash != null || userLogins.Count > 1;
         return View(new ManageLoginsViewModel
         {

diff --git a/sandbox/OpenIddict.Sandbox.AspNet.Server/Controllers/ResourceController.cs b/sandbox/OpenIddict.Sandbox.AspNet.Server/Controllers/ResourceController.cs
@@ -1,4 +1,5 @@
-using System.Collections.Generic;
+using System;
+using System.Collections.Generic;
 using System.Net;
 using System.Net.Http;
 using System.Security.Claims;
@@ -27,7 +28,7 @@ public async Task<IHttpActionResult> GetMessage()
         {
             context.Authentication.Challenge(
                 authenticationTypes: OpenIddictValidationOwinDefaults.AuthenticationType,
-                properties: new AuthenticationProperties(new Dictionary<string, string?>
+                properties: new AuthenticationProperties(new Dictionary<string, string?>(StringComparer.Ordinal)
                 {
                     [OpenIddictValidationOwinConstants.Properties.Scope] = "demo_api",
                     [OpenIddictValidationOwinConstants.Properties.Error] = Errors.InsufficientScope,
@@ -43,7 +44,7 @@ public async Task<IHttpActionResult> GetMessage()
         {
             context.Authentication.Challenge(
                 authenticationTypes: OpenIddictValidationOwinDefaults.AuthenticationType,
-                properties: new AuthenticationProperties(new Dictionary<string, string?>
+                properties: new AuthenticationProperties(new Dictionary<string, string?>(StringComparer.Ordinal)
                 {
                     [OpenIddictValidationOwinConstants.Properties.Error] = Errors.InvalidToken,
                     [OpenIddictValidationOwinConstants.Properties.ErrorDescription] =

diff --git a/sandbox/OpenIddict.Sandbox.AspNetCore.Client/Controllers/AuthenticationController.cs b/sandbox/OpenIddict.Sandbox.AspNetCore.Client/Controllers/AuthenticationController.cs
@@ -24,7 +24,7 @@ public async Task<ActionResult> LogIn(string provider, string returnUrl)
         // the user is directly redirected to GitHub (in this case, no login page is shown).
         if (string.Equals(provider, "Local+GitHub", StringComparison.Ordinal))
         {
-            var properties = new AuthenticationProperties(new Dictionary<string, string?>
+            var properties = new AuthenticationProperties(new Dictionary<string, string?>(StringComparer.Ordinal)
             {
                 // Note: when only one client is registered in the client options,
                 // specifying the issuer URI or the provider name is not required.
@@ -54,7 +54,7 @@ public async Task<ActionResult> LogIn(string provider, string returnUrl)
                 return BadRequest();
             }
 
-            var properties = new AuthenticationProperties(new Dictionary<string, string?>
+            var properties = new AuthenticationProperties(new Dictionary<string, string?>(StringComparer.Ordinal)
             {
                 // Note: when only one client is registered in the client options,
                 // specifying the issuer URI or the provider name is not required.
@@ -96,7 +96,7 @@ public async Task<ActionResult> LogOut(string returnUrl)
         if (identity.FindFirst(Claims.Private.RegistrationId)?.Value is string identifier &&
             await _service.GetServerConfigurationByRegistrationIdAsync(identifier) is { EndSessionEndpoint: Uri })
         {
-            var properties = new AuthenticationProperties(new Dictionary<string, string?>
+            var properties = new AuthenticationProperties(new Dictionary<string, string?>(StringComparer.Ordinal)
             {
                 [OpenIddictClientAspNetCoreConstants.Properties.RegistrationId] = identifier,
 

diff --git a/sandbox/OpenIddict.Sandbox.AspNetCore.Server/Controllers/AccountController.cs b/sandbox/OpenIddict.Sandbox.AspNetCore.Server/Controllers/AccountController.cs
@@ -71,11 +71,9 @@ public async Task<IActionResult> Login(LoginViewModel model, string returnUrl =
             {
                 return View("Lockout");
             }
-            else
-            {
-                ModelState.AddModelError(string.Empty, "Invalid login attempt.");
-                return View(model);
-            }
+
+            ModelState.AddModelError(string.Empty, "Invalid login attempt.");
+            return View(model);
         }
 
         // If we got this far, something failed, redisplay form
@@ -173,14 +171,12 @@ public async Task<IActionResult> ExternalLoginCallback(string returnUrl = null)
         {
             return View("Lockout");
         }
-        else
-        {
-            // If the user does not have an account, then ask the user to create an account.
-            ViewData["ReturnUrl"] = returnUrl;
-            ViewData["LoginProvider"] = info.LoginProvider;
-            var email = info.Principal.FindFirstValue(ClaimTypes.Email);
-            return View("ExternalLoginConfirmation", new ExternalLoginConfirmationViewModel { Email = email });
-        }
+
+        // If the user does not have an account, then ask the user to create an account.
+        ViewData["ReturnUrl"] = returnUrl;
+        ViewData["LoginProvider"] = info.LoginProvider;
+        var email = info.Principal.FindFirstValue(ClaimTypes.Email);
+        return View("ExternalLoginConfirmation", new ExternalLoginConfirmationViewModel { Email = email });
     }
 
     //
@@ -367,11 +363,11 @@ public async Task<IActionResult> SendCode(SendCodeViewModel model)
         }
 
         var message = "Your security code is: " + code;
-        if (model.SelectedProvider == "Email")
+        if (string.Equals(model.SelectedProvider, "Email", StringComparison.Ordinal))
         {
             await _emailSender.SendEmailAsync(await _userManager.GetEmailAsync(user), "Security Code", message);
         }
-        else if (model.SelectedProvider == "Phone")
+        else if (string.Equals(model.SelectedProvider, "Phone", StringComparison.Ordinal))
         {
             await _smsSender.SendSmsAsync(await _userManager.GetPhoneNumberAsync(user), message);
         }
@@ -418,11 +414,9 @@ public async Task<IActionResult> VerifyCode(VerifyCodeViewModel model)
         {
             return View("Lockout");
         }
-        else
-        {
-            ModelState.AddModelError("", "Invalid code.");
-            return View(model);
-        }
+
+        ModelState.AddModelError("", "Invalid code.");
+        return View(model);
     }
 
     #region Helpers
@@ -460,10 +454,8 @@ private IActionResult RedirectToLocal(string returnUrl)
         {
             return Redirect(returnUrl);
         }
-        else
-        {
-            return RedirectToAction(nameof(HomeController.Index), "Home");
-        }
+
+        return RedirectToAction(nameof(HomeController.Index), "Home");
     }
 
     #endregion