search

aspnet / AspNetKatana

Microsoft's OWIN implementation, the Katana project
Apache License 2.0
968 stars 334 forks source link

'OwinStartupAttribute' is inaccessible due to its protection level #503

Closed samgrimmer closed 1 year ago

samgrimmer commented 1 year ago

Hi,

Excuse me, but this maybe a simple question.

I'm in the process of upgrading an older project that previously used microsoft.owin 2.1.0 to microsoft.owin 3.1.0.

The project uses a startup file for the hooks. It seems the 'OwinStartup' attribute is no longer the approach, as I am getting the error 'OwinStartupAttribute' is inaccessible due to its protection level.

Is someone able to stare me towards the right path?

image

CZEMacLeod commented 1 year ago

@samgrimmer I don't know if there is a specific issue with 3.1.0 and that attribute, but the latest version of Microsoft.Owin.* is 4.2.2. I would suggest moving to that version if possible. You may need to update the target framework version to be higher, but there are also known security vulnerabilities in 3.1.0 that you should avoid.

This package has at least one vulnerability with high severity. It may lead to specific problems in your project. Try updating the package version.

Advisory Severity
https://github.com/advisories/GHSA-3rq8-h3gj-r5c6 high
https://github.com/advisories/GHSA-hxrm-9w7p-39cc high

Separately, your screenshot shows that the namespace Microsoft.Owin is not being used (as it is greyed out), which suggests that OwinStartup is being picked up from another namespace. Try fully qualifying the attribute as Microsoft.Owin.OwinStartup and see if that helps. You may also find that you can hover the attribute and see what it is being resolved as.

Tratcher commented 1 year ago

Hmm, it's public right here: https://github.com/aspnet/AspNetKatana/blob/3c194663090eeea35e5ee95cbe54959e0b90e3e3/src/Microsoft.Owin/Loader/OwinStartupAttribute.cs#L6-L12

Can you share your full list of dependencies and versions? And yes, you should be using the latest 4.x versions.

samgrimmer commented 1 year ago

Thanks guys for the reply. I am upgrading a clients third party libraries required for some auction software. Their libraries dependency's require the 3.1.0 version.

Turns out an older version within the solution was somehow still being referenced, so after removing the package at the solution level, as well as cleaning the respective project bin folders, I was able to resolve the issue.