- allow client registration update fields to be omitted by the client (9df9bd7), closes #664
- client credentials exchange checks the client’s scope whitelist (5e4defc)
- stable features with ack now throw to indicate a possible breaking change (cf58d35)
- typescript: adapter methods typings and interface name typo (e086fc6)
- features.mTLS (RFC 8705) is now a stable feature (cfeaca8)
- typescript: correct KoaContextWithOIDC definition, take 2 (84d32fc), closes #659
- typescript: correct KoaContextWithOIDC definition (655ea29), closes #659
- add support for RSA-OAEP-384 and RSA-OAEP-512 JWE algorithms (c669bd1)
- allow opt-in refresh_token grant without offline_access as in 5.x (b67a3a6), closes #647
- typescript: remove @types/node from runtime dependencies (55a5074), closes #646
interaction.started listener second argument type fixed (2fe67a9), closes #643
- allow koa context argument in idFactory and secretFactory (76aa942), closes #455
- set samesite compatibility cookie as transient when the session is (1257164), closes #636
- allow ECDH-ES with AES_CBC_HMAC_SHA2 key sizes larger than 256 bits (a65e9c4)
- allow overloading prototype for comparing client secrets (eec36eb), closes #631
- number of default should-change notices using a wrong property (8e51724)
- principal-change triggered logout fixes (fa860cf), closes #628 #600
- fix client secret based algorithm keys for clients with jwks (75d82a0)
- update PAR implementation to an ietf WG draft version (d3a772b)
- typescript: rotateRefreshToken boolean, ES256K, async customizers (22ab1e3)
- skip JWT validating iat is in the past when exp is present (a7dd855)
- properly handle routes ending with a trailing slash (again) (d8a3a67)
- properly handle routes ending with a trailing slash (c4b06de)
- allow empty body without content-type on userinfo (d5148ad)
- forbid “none” id token algorithm when backchannel logout is used (797919e)
- registered native loopback redirect_uris do not get normalized (96e035f)
- add support for secp256k1 elliptic curve use (30aa706)
- use shake256(m, 114) for Ed448 ID Token
*_hash claims (7e6ba6f)
- add script tag nonce resolution helper for session management and wmrm (#584) (b32b8e6), closes #583
- ensure BaseModel descendants have an exp property (22cc547), closes #580
- regression introduced in 58f7348 (4738a8b)
- add jwsreq Accept value to request_uri resolver (cec4016)
- expose client schema invalidate(err, code) to enable customization (d672ee8)
- ignore httpOnly and domain configuration options for resume cookies (952d68e), closes #574
← Newer entries | Older entries →
