JWKS endpoint escapes '+' as '\u002B' in x5c field

[asos-jasperdeluna]

The JWKS endpoint returns \u002B instead of literal + in Base64-encoded x5c certificate values:
"x5c": ["MIIF...CNDO10w\u002BRnuMEzkifo..."]

I think the root cause was raised here: dotnet/runtime#50998

We've identified some potential workarounds. Could you advise which approach you'd recommend?

1. Base64URL encoding - Re-encode x5c using Base64URL to avoid + characters (though this may violate RFC 7517 which specifies standard Base64)
2. Middleware rewrite - Intercept the JWKS response and replace \u002B with +
3. Override JsonSerializerOptions - Configure ASP.NET Core's default JSON options (though we suspect this won't work as IdentityServer uses its own ObjectSerializer)

Environment

• Duende IdentityServer version: 7.2.4
• .NET version: 9.0

References

• System.Text.Json is converting "+" to "\u002B" dotnet/runtime#50998 - System.Text.Json escaping + as \u002B
• https://datatracker.ietf.org/doc/html/rfc7517#section-4.7 - x5c parameter definition
• https://datatracker.ietf.org/doc/html/rfc7638#section-3.3 - JWK Thumbprint canonical JSON

[josephdecock]

Thanks very much for this detailed bug report! I agree with your reading of the standards. We should not be escaping the plus character in this way, and it does indeed look like it is behavior that we are getting from System.Text.Json. My hypothesis is that this changed when the underlying System.IdentityModel.* libraries changed to use System.Text.Json. My advice for a short-term workaround is to go with middleware (your option 2). Meanwhile, the development team is working on a fix.

[josephdecock]

You mentioned in your report that you're using IdentityServer 7.2.4. If we fixed this in a 7.4.x patch, are you able to upgrade to 7.4 to use the fix? 7.2 to 7.4 should be a very straightforward upgrade. We had no schema changes, and only very minimal instances of breaking changes - code changes are needed in only very rare cases.

[asos-jasperdeluna]

Thanks @josephdecock we can upgrade to 7.4.x and we're currently on .NET 9 so there shouldn't be any compatibility issues on our end. Please let me know when the patch is available and we'll proceed with the upgrade.