The 6.1 release is a major release which includes usability, security and performance improvements.
Static Asset Caching and Fingerprinting
Browsers and content delivery networks (CDNs) have the ability to cache content. This capability can provide a significant performance benefit for websites which usually contain a variety of static assets that do not change frequently. However one of the challenges with caching content is that if an asset is modified, you want users to get the new version of that asset immediately. This is referred to as "cache busting" and can be solved by using a technique known as "fingerprinting", which essentially appends a unique identifier to an asset Url that changes when an asset is modified.
Oqtane 6.1 now includes the ability to enable static asset caching. The screen shot below demonstrates how a Cache-Control directive can be specified in System Info. In this case, the directive "public, max-age=86400" means that static assets can be cached on a "public" CDN and will expire after 1 day. Oqtane will fingerprint static core framework assets as well as any module or theme assets automatically based on their version. Note that in order to avoid any behavioral impacts to existing sites, static asset caching is NOT enabled by default... a host user must explicitly enable it.
Static asset caching has been enabled on this site (https://www.oqtane.org) and the Lighthouse performance metrics revealed an immediate improvement:
It should be noted that although .NET 9 included a new MapStaticAssets() capability, Oqtane was not able to use this approach. This is because the feature in .NET 9 was designed for monolithic Blazor applications where all of the assets are known at build time, whereas Oqtane is a loosely coupled modular framework where the UI is composed at run-time from a variety of components. As a result, Oqtane had to utilize a custom solution based on its own unique characteristics.
Folder Asset Caching
Oqtane contains a File Management capability which allows users to upload files to the system at run-time. Oqtane 6.1 now includes the ability to enable caching on specific folders. The screen shot below demonstrates a Cache-Control directive for a Folder ("public, max-age=604800") where the static assets will be cached for 1 week. It should be noted that folder caching does not include automatic fingerprinting of file assets, so cache busting must be handled manually.
File Upload
Oqtane has always included the ability to upload files, including the ability to upload multiple files in a single operation and uploading files of various sizes. Allowing users to upload very large files is a complex challenge due to technical limitations, so the most common approach is to split large files into smaller chunks which can be uploaded independently and then reassembled on the server. This is the approach which Oqtane has always used as it works in every Blazor hosting model and render mode. In Oqtane 6.1 the workflow for uploading chunks to the server has been optimized to provide a more consistent and predictable user experience.
The various settings related to uploading files have been migrated from the Site Settings UI to a Settings tab within File Management. In addition, a new setting has been introduced which allows you to configure the maximum chunk size during upload. The system default is 1 MB, however if your users are on a fast network you can increase the chunk size to improve upload performance.
Impersonate User
A common scenario when managing a website or web application is a need to replicate the exact experience which another user is having. This might be for testing purposes to ensure functionality is working as intended, or it could be for support purposes to reproduce a problem which a user has reported. Oqtane 6.1 now includes an impersonation feature where an Administrator can temporarily impersonate another user. This feature can be accessed through User Management by locating the user you wish to impersonate, selecting the Edit option, and then selecting the Impersonate option. At this point you will assume the identity of the user including their specific security roles. In order to revert back to your own account, you will need to logout and login once again. It should also be noted that users with host privileges cannot be impersonated (for obvious reasons).
External Login and Save Tokens for Downstream APIs
When authenticating against a remote Identity Provider (ie. using OAuth2 or OIDC), a user may wish to interact with downstream APIs using the security context they obtained from the Identity Provider. Oqtane 6.1 includes a new option in User Management - Settings - External Login for Save Tokens. This option allows the system to save the authorization and refresh token from the Identity Provider so that it can be passed to remote APIs (using RemoteServiceBase). Note that this option is disabled by default as the size of the authorization and refresh tokens can sometimes result in performance issues.
Url Mapping Retention
Oqtane contains a capability to track all broken Urls for pages and files. This is very useful in identifying Urls which have changed and should be mapped to a valid location. However due to the large number of nefarious crawlers and bots on the web, the majority of broken Urls which are recorded are actually related to invalid requests. Over time, this list can become quite large and in Oqtane 6.1 a new feature was added which allows you to specify a retention policy. By default, only broken Urls which have been requested in the past 30 days will be retained - older records will be automatically deleted (by the daily Purge Job).
To date, the open source project has recorded over 2838 pull requests from 58 contributors and has published 52 official releases, which ranks it among the most active open source projects within the .NET Foundation. The Oqtane framework continues to evolve at a rapid pace to meet the needs of the .NET community. The 6.1 release is available for download on Github and is running in production at https://www.oqtane.org, https://www.blazorcms.net, and https://www.blazorkit.net.
