Windows: plugin cannot build — vcpkg removed the cpprestsdk port

[AnasAbuOmar]

Checklist

• The issue can be reproduced in the auth0_flutter sample app (or N/A). — N/A, the sample does not target Windows
• I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

The Windows plugin requires the vcpkg port cpprestsdk, which vcpkg removed on 2026-06-02. Any Windows build against a vcpkg checkout newer than that date fails during CMake configure, before anything is compiled.

This is not environment-specific — it reproduces on GitHub's windows-latest runner with its preinstalled vcpkg, and will affect anyone who has cloned or updated vcpkg since early June.

The failure:

C:\vcpkg\ports\cpprestsdk: error: cpprestsdk does not exist

surfaced by CMake only as:

CMake Error at C:/vcpkg/scripts/buildsystems/vcpkg.cmake:984 (message):
  vcpkg install failed.  See logs for more information:
  ...\build\windows\x64\vcpkg-manifest-install.log
Call Stack (most recent call first):
  CMakeLists.txt:38 (project)

The text naming cpprestsdk appears only in vcpkg-manifest-install.log. Console output never mentions it, which makes this hard to diagnose in CI where that file is discarded with the runner.

Root cause:

vcpkg commit	Date
d015e31e90838a4c9dfa3eed45979bc70d9357fc	2026-05-25	last commit where ports/cpprestsdk exists
9ceec72e0a30d87c469cec7d268047eb1f0424bb	2026-06-02	[cpprestsdk, azure-storage-cpp] Deindex. (#52130)

ports/cpprestsdk no longer exists on vcpkg master. Microsoft archived the C++ REST SDK and vcpkg de-indexed it.

The dependency is declared in auth0_flutter/windows/vcpkg.json and required at auth0_flutter/windows/CMakeLists.txt:44:

find_package(cpprestsdk CONFIG REQUIRED)

It is used across a fair portion of the plugin — auth0_api_client.cpp, authentication_api_client.cpp, oauth_helpers.{h,cpp}, id_token_signature_validator.cpp, jwt_util.h, token_decoder.h, user_identity.h, authentication_error.h, windows_utils.cpp — so I appreciate this likely isn't a one-line substitution.

Suggested resolution: migrate the Windows plugin off cpprestsdk. It is archived upstream and now absent from vcpkg, so it will keep costing every consumer. WinHTTP or libcurl would both remove the dependency, and openssl is already declared for the signature-validation path.

Reproduction

Reproduces consistently.

1. Flutter app with auth0_flutter: ^2.6.0 and Windows enabled
2. A vcpkg checkout newer than 2026-06-02, with VCPKG_ROOT set
3. flutter build windows

Confirmed on windows-latest (Visual Studio 18, CMake 4.3, vcpkg at C:\vcpkg).

Workaround, for anyone else hitting this — pin a vcpkg baseline from before the removal, in the application's windows/vcpkg.json:

{
  "name": "your-app",
  "dependencies": ["cpprestsdk", "openssl", "boost-system", "boost-date-time", "boost-regex"],
  "builtin-baseline": "d015e31e90838a4c9dfa3eed45979bc70d9357fc"
}

This produces a green Windows build. It is a stopgap rather than a fix: a baseline pins every port to that date, OpenSSL included, so an application handling authentication tokens ends up freezing its TLS library to keep a login plugin building.

Additional context

Consumers must supply their own vcpkg manifest — possibly worth a separate issue, but it shares a cause with the confusion above.

EXAMPLES.md states:

The plugin's vcpkg.json manifest automatically pulls the required packages (cpprestsdk, openssl, boost-system, boost-date-time, boost-regex) at build time — no manual vcpkg install is needed.

In manifest mode, vcpkg reads vcpkg.json from CMAKE_SOURCE_DIR, which for a Flutter app is the application's windows/ directory — not the plugin's. The plugin's manifest is therefore never read, and a consumer following the documentation exactly gets:

Could not find a package configuration file provided by "cpprestsdk"

with the toolchain correctly configured, which is a confusing place to land. The fix on the consumer side is to create windows/vcpkg.json in the application duplicating the plugin's dependency list. Documenting that step — or having the plugin's CMake set VCPKG_MANIFEST_DIR — would save others the same detour.

Relatedly, the setup instructions read VCPKG_ROOT, but GitHub's Windows runners ship vcpkg and expose it as VCPKG_INSTALLATION_ROOT. Mentioning both would help anyone wiring this into CI.

Minor: the Platform dropdown in this issue template offers only Android / iOS / Web, though the README documents Windows 10+ and macOS 11+ support.

[NandanPrabhu]

Hi @AnasAbuOmar, thanks for raising the github issue. We are working on moving away from cpp rest sdk and using a different package