Search code examples
c#asp.net-core-2.1.net-4.8

How to update ASP.NET Core 2.1 (running on .NET Framework) to newer builds?

I have an old app running on ASP.NET Core 2.1 and running on .NET Framework (yes, that is a thing).

OK fine. But I need to update that old project to include some new updates - specifically patched UseCookiePolicy support - as described at https://devblogs.microsoft.com/dotnet/upcoming-samesite-cookie-changes-in-asp-net-and-asp-net-core/comment-page-3/ - and some other security patches).

Extract from the csproj file:

    <TargetFramework>net48</TargetFramework>
    <AspNetCoreModuleName>AspNetCoreModuleV2</AspNetCoreModuleName>
    <AspNetCoreHostingModel>OutOfProcess</AspNetCoreHostingModel>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Microsoft.AspNetCore" Version="2.1.7" />
    <PackageReference Include="Microsoft.AspNetCore.Mvc" Version="2.1.3" />
    <PackageReference Include="Microsoft.AspNetCore.Authentication.Cookies" Version="2.1.2" />
    <PackageReference Include="Microsoft.AspNetCore.Authentication.Core" Version="2.1.1" />
    <PackageReference Include="Microsoft.AspNetCore.Mvc.Versioning" Version="3.0.1" />
    <PackageReference Include="Microsoft.Extensions.Configuration" Version="2.1.1" />
    <PackageReference Include="Microsoft.Extensions.Logging" Version="2.1.1" />
  </ItemGroup>

So we can see that the ASP.NET Core dependencies are referenced via NuGet.

OK, fine - so I need to go and update those packages. But here comes the issue - the packages don't exist any more. https://www.nuget.org/packages/Microsoft.AspNetCore/2.1.7 is the latest version, but alas that was released prior to the fixes that I need. https://github.com/dotnet/announcements/issues/217 is the announcement where they said they would stop generating the NuGet packages.

So now I am a bit stuck. I can download the latest SDK etc from https://github.com/dotnet/core/blob/main/release-notes/2.1/2.1.30/2.1.30.md#downloads - but how do I change my project from its NuGet references to the files at C:\Program Files\dotnet\shared instead?

You may be tempted to suggest using https://www.nuget.org/packages/Microsoft.AspNetCore.App/2.1.34#supportedframeworks-body-tab - but that doesn't work either since it explicitly excludes .NET Framework support.

.NET Core 2.1 on .NET Framework is a supported thing. How do other people solve this upgrade problem?

Solution

  • As per ASP.NET Core 2.1 MVC SameSite cookie sample (found via https://stackoverflow.com/a/65834637/34092):

    To get the ASP.NET Core changes for .NET Framework ensure that you have a direct reference to the patched packages and versions (2.1.14 or later 2.1 versions).

    <PackageReference Include="Microsoft.Net.Http.Headers" Version="2.1.14" />
<PackageReference Include="Microsoft.AspNetCore.CookiePolicy" Version="2.1.14" />