- revocation: add an allowed token revocation policy helper (a7e47e4)
- introspection: use unsupported_token_type to indicate structured jwt tokens cannot be introspected (c9001be)
- revocation: use unsupported_token_type to indicate structured jwt tokens cannot be revoked (b45b00c)
- pull structured token rejection to a shared middleware (30367af)
- expose RFC8414 Authorization Server Metadata route (c5bd90f)
- ensure an account’s accountId and claims().sub is the same (9b89153), closes #1336
- ignore allowOmittingSingleRegisteredRedirectUri when FAPI 2.0 is used (e2de529)
- oidc-provider now uses koa@3 (3a83d32)
- experimental support for OIDC RP Metadata Choices (f3550da)
- only include DPoP-Nonce in Access-Control-Expose-Headers when DPoP is enabled (e769aa8)
- avoid assignment operators in conditional expressions (b7ed877)
- improve static find performance (106f94a)
- update some default helpers for readability (0818c36)
- more clarity for features.dPoP.allowReplay (779a141)
- mark experimental features more distinctly (986adc5)
- update references and styling of spec links (a4787b8)
- DCR endpoints only include www-authenticate for non-registration related errors (9a864d6)
- client schema defaults and static props (843943d)
- handle frame-ancestors in wmrm without a regexp (4f85585)
- push multiple elements to the recognized array in client_schema (d478a8b)
- simpler DCR validate registration access token (5f01eda)
- authorization and logout endpoints no longer support the HTTP POST method by default, this can be re-enabled using the
enableHttpPostMethods boolean configuration, this also requires that cookies.long.sameSite is set to none
- cookie session sameSite attribute default is now “lax” instead of “none”
- userinfo requests with bearer tokens will now fail if they also include DPoP
- userinfo now includes both dpop and bearer challenges when dpop is enabled
- accessing protected resources without an access token will now yield a 401 HTTP Status Code instead of a 400
- default PKCE configuration no longer requires PKCE to be used unless RFC9700 or a given profile says so
- removed the provider.Account getter
- all Provider routes will now end the HTTP request when finished, koa middlewares that are “downstream” will no longer be executed after a route is matched in oidc-provider, “upstream” control flows are unaffected
- the Provider no longer includes a catch-all 404 Not Found error handler
- FAPI profile behaviours no longer force PKCE, these should be forced by configuring the pkce.required configuration helper the default of which already does so.
- the server’s JWK Key IDs (JWK kid parameter) now must be unique, no two keys must use the same kid.
- the revokeGrantPolicy configuration helper is now also invoked during opaque Access Token revocation, its default return remains false for this case though
- CIBA ping and poll delivery mode ID Tokens no longer include at_hash, urn:openid:params:jwt:claim:rt_hash, and urn:openid:params:jwt:claim:auth_req_id
- authorization code grant type issued ID Tokens no longer include at_hash
- device authorization grant type issued ID Tokens no longer include at_hash
- refresh token grant type issued ID Tokens no longer include at_hash
- implicit grant type issued ID Tokens no longer include s_hash unless the request is a FAPI 1.0 Final request
- global fetch() API is now used to make outgoing HTTP requests instead of the “got” module.
- the httpOptions configuration option was removed and a new option to accomodate the use of fetch() interface was added. This options is aptly called “fetch” and its call signature and expected returns mirror the fetch() API.
- Enabling JAR (Request Objects by Value) is now enabled via features.requestObjects.enabled boolean instead of features.requestObjects.request boolean
- removed support for Passing a Request Object by Reference (JAR request_uri)
- removed legacy sameSite cookie fallback
- removed support for Node.js 18.x
- removed support for Node.js 20.x
- removed the pkce.methods configuration
- removed the features.requestObjects.mode configuration
- removed support for Ed448
- removed support for X448
- removed support for secp256k1 / ES256K
- removed support for FAPI 1.0 ID2
- Access Token revocation may now also optionally revoke the underlying grant (4f69668)
- add support for the fully-specified Ed25519 JWS Algorithm Identifier (645b900)
- DPoP support is now enabled by default (a5694af)
- Experimental support for external signing keys, e.g. in a KMS or HSM (8b3ceff)
- expose current requests’ ctx via Provider.ctx static getter (1fbd81b)
- update FAPI 2.0 implementation to FAPI 2.0 Final (eff3115)
- auto-format code blocks (c2c520f)
- dpop cannot acked anymore, it is stable (a48c51f)
- improvements to linked resources (cf77770)
- mention external types (5f8a450)
- move adapters to the Community Guides Discussions section (ba806ca)
- move recipes to the Community Guides Discussions section (cd8da28)
- remove mentions of the connect server framework (7cb1aaa)
- update README to use named exports (8355886)
- update version support matrix (abbfe2f)
- no access token provided error is now a 401 (8493e2d)
- userinfo now includes both dpop and bearer challenges when dpop is enabled (1093f6b)
- change default PKCE usage requirement (fdf8ad8)
- change default session cookie from sameSite none to lax (b47eee8)
- cleanup unused azp claim code (6c57e63)
- deprecate the
.app getter (9b61212)
- disable HTTP POST Method handling of authorization and logout endpoints (d56304c)
- encryption and key derivation is not blocking the main thread (73a422f)
- ensure all route handlers are final (8cc44e6)
- escape www-authenticate backslashes despite not directly using them (e789b98)
- increase all random identifiers from ~126 bits of randomness to ~256 (45721f8)
- minimal change to support koa@3 (925cee5)
- no more warnings if cookie keys are missing (7ab6157)
- omit generic “typ: JWT” in issued JSON Web Tokens (4eb4004)
- pass over internal configuration getters (0243964)
- Provider is now the Koa application instance (167216e)
- remove hardcoded require PKCE checks (be0b2fd)
- remove object-hash dependency (fda9385)
- remove optional ID Token _hash claims (58ca2c2)
- remove the provider.Account getter (dd2bde4)
- remove unused code (e5fc3cb)
- remove uses of randomFill and Buffer.allocUnsafe (00fe106)
- removed legacy sameSite cookie fallback (2defa70)
- removed support for FAPI 1.0 ID2 (311e3e2)
- removed support for Passing a Request Object by Reference (JAR request_uri) (bacf375)
- removed the features.requestObjects.mode configuration (4ec8327)
- removed the pkce.methods configuration (4a736b8)
- Request Object (JAR) is now enabled with features.requestObjects.enabled (20d60a4)
- simplify default assertJwtClaimsAndHeader configuration (1ea27a6)
- update Node.js support matrix (db57556)
- use fetch() api to make outgoing HTTP requests (cc70e5a)
- use hkdf in dpop’s rolling nonce calculation (7b77967)
- use more optional chaining (e5539ae)
- use oneshot hash methods instead of intermediate Hash objects (2dc4bd1)
- use structuredClone instead of JSON.stringify then parse (ad02170)
- use URL.parse (11e1b33)
- userinfo requests with bearer tokens will now fail if they also include DPoP (e5efa5c)
- mark RFC9701 (features.jwtIntrospection) as stable (e2a2de2)
- allow own KeyGrip instances in cookies.keys configuration (d5d2900)
- allow specifying the user-agent header for outgoing requests (#1287) (c77513c)
- add a helper for asserting JWT Client Auth claims and header (82d4e50)
- update verbiage “provider” > “authorization server” (3768192)
- move assertJwtClaimsAndHeader after regular JWT claims set validation (05f6bf4)
- normalize single string set-cookie headers (6effeed)
- remove use of node:url in favour of WHATWG URL (0dc59a1)
- build: export Provider also as a named export (083c7c4)
- add a Client static validate() method (d1f7d73)
- add a helper allowing custom claims parameter validations (ec2a1f5)
- add experimental support for RFC9396 - Rich Authorization Requests (e9fb573)
- add response_modes client metadata allow list (76f9af0)
- allow extraParams to define validations for extra parameters (b7d3322)
- DPoP: add a setting to disable DPoP Proof Replay Detection (2744fc8)
- DPoP: send a dpop-nonce when the proof’s iat check fails and nonces are configured but not required (1b073c0)
- FAPI: add FAPI 2.0 profile behaviours (5212609)
- JAR: add a helper allowing custom JWT claim and header validations (be9242a)
- PAR: add a setting to allow use of unregistered redirect_uri values (a7e73fa)
- update Web Message Response Mode and remove its Relay Mode (a91add8)
- DPoP,mTLS: reject client configuration in which binding is required but response types include an implicit token response (cd7e0f4)
- deprecate FAPI 1.0 ID2, lax request objects, plain PKCE (3e8a784)
- don’t use overwrite cookie option by default (dfbcb94)
- DPoP: move the accepted timespan into a constant (a8e8006)
- DPoP: omit sending the dpop-nonce header if the existing one used is fresh (4d635e2)
- ensure param-assigned max_age from client.defaultMaxAge is a string (0c52469)
- FAPI: deprecate FAPI profile hardcoded PKCE checks (56641ec)
- JAR: authorization requests with JAR now require a client_id parameter (9131cd5)
- JAR: Request Objects are no longer checked for one time use (18efa70)
- PAR: consume PAR after user interactions instead of before (53babe6)
- store claims value parsed in non-JAR PAR (9cd865b)
- use invalid_request instead of unauthorized_client (7947d87)
- include ID Token auth_time when client’s default_max_age is zero (bebda04)
- adds events and debugging recipe (#1246) (0bf7696)
- fix client_secret_basic special characters encoding example (73baae1)
- re-run update docs (99cc84a)
- avoid iteration resource iteration in client_credentials (e306640)
- avoid use of prototype attributes in object-hash (270af1d)
- use logical or assignment (8f55588)
- ensure each individual resource indicator is a valid URI (d9e1ad2)
- use doc argument in web_message js code (da3198b)
- add missing opening html tags (23997c5)
- DPoP: mark defaulted dpop_jkt parameter as trusted (ee633f3)
- test decoded basic auth tokens for their VSCHAR pattern (3f86cc0)
- DPoP,PAR,JAR: validate DPoP before invalidating JAR during PAR (ca0f999)
- DPoP: remove experimental flag, DPoP is now RFC9449 (89d133e)
- assign extraTokenClaims return to the model (e296dc7)
- DPoP: compare htu scheme and hostname case independent (b72d668)
- allow specifying the user-agent header for outgoing requests (95f24ef)
- ignore non-existent resource scopes during refresh (#1222) (bdf23ba)
- ignore post_logout_redirect_uris when logout is disabled (#1221) (d7dd6cf)
← Newer entries | Older entries →
