Download TMS Business Core Library v2.6.0.0 Full Source for D10-D13

Version 2.6 (October-2026)

• New: Application configuration. Keep the settings of your application - server URL, database connections, passwords - in a JSON file beside the executable and read them from anywhere with TConfiguration.Current, with no setup code. The same executable runs unchanged in development, test and production: each deployment overrides only what differs, using environment variables, as Docker and cloud platforms expect.

• New: JWT tokens can now be signed and validated using OpenSSL 3. Add the new Bcl.OpenSsl.Jose unit to your project and RSA (RS256/RS384/RS512, PS256/PS384/PS512) and ECDSA (ES256/ES256K/ES384/ES512) signing works against the OpenSSL version that current Windows, Linux and macOS systems actually ship, with no dependency on Indy. Until now this needed the OpenSSL 1.0 libraries, which reached end of life in 2019 and are absent from modern systems; applications that still deploy them keep working unchanged, as the previous implementation is used whenever OpenSSL 3 cannot be loaded.

• New: JSON Web Key (JWK) support, through TJSONWebKey and TJSONWebKeySet. A JWK is the standard JSON representation of a cryptographic key, and a JWK Set is how an identity server publishes the public keys it signs tokens with. You can now read such a document, let the library pick the key a given token was signed with, convert keys between JWK and PEM, and compute the standard key fingerprint (RFC 7638 thumbprint). Keys of a type the library does not support, such as the Ed25519 keys some identity servers now publish, are skipped, so the rest of the set remains usable.

• New: RSASSA-PSS signing (PS256, PS384, PS512). PSS is the modern RSA signature scheme, recommended over the older RS* algorithms for new applications and required by some identity providers.

• New: TJOSE.VerifyOrRaise raises an exception when a token does not verify, so a token it returns is always one that checked out. TJOSE.Verify still returns a token whose Verified property has to be tested.

• Improved: The JOSE/JWT library was updated to the latest files of the Delphi JOSE JWT library (https://github.com/paolo-rossi/delphi-jose-jwt), which we use as a base for our implementation. Its license changed from Apache 2.0 to MIT.

• Fixed: Unsigned tokens (alg=none) were accepted by a consumer that had not explicitly listed the algorithms it expects. They are no longer accepted by default. See Breaking Changes.

• Fixed: A consumer kept alive for a long time went on accepting expired tokens, because it evaluated every token against the time of its first validation instead of the current time.

• Fixed: A PEM public key was accepted as an HMAC shared secret. Anyone holding the public key of an RS256 issuer could therefore forge an HS256 token that such a verifier would accept.

• Fixed: The signing key was not validated in TJOSE.Verify, TJOSE.DeserializeCompact and the producer API, so a key too short for the chosen algorithm was used without complaint.

• Fixed: Signatures were compared byte by byte with an early exit, which leaks information about the expected value through the time taken. The comparison is now constant time.

• Fixed: Token parts were accepted with padding, whitespace, line breaks and other spellings that are not valid base64url, so the same token had many accepted wire forms.

• Fixed: Whole numbers in a token above 2^53 lost precision when read, which could corrupt identifier-like claims.

• Fixed: Exception messages raised during validation could contain the token's claims and signature, which routinely end up in log files.

• Fixed: An access violation could occur after a token failed to parse.

• Fixed: Registering the cryptography providers was not thread-safe.

• Fixed: Conversions between time units were inaccurate, which could shift the expiration of a token.