- update PAR implementation to an ietf WG draft version (d3a772b)
- typescript: rotateRefreshToken boolean, ES256K, async customizers (22ab1e3)
- skip JWT validating iat is in the past when exp is present (a7dd855)
- properly handle routes ending with a trailing slash (again) (d8a3a67)
- properly handle routes ending with a trailing slash (c4b06de)
- allow empty body without content-type on userinfo (d5148ad)
- forbid “none” id token algorithm when backchannel logout is used (797919e)
- registered native loopback redirect_uris do not get normalized (96e035f)
- add support for secp256k1 elliptic curve use (30aa706)
- use shake256(m, 114) for Ed448 ID Token
*_hash claims (7e6ba6f)
- add script tag nonce resolution helper for session management and wmrm (#584) (b32b8e6), closes #583
- ensure BaseModel descendants have an exp property (22cc547), closes #580
- regression introduced in 58f7348 (4738a8b)
- add jwsreq Accept value to request_uri resolver (cec4016)
- expose client schema invalidate(err, code) to enable customization (d672ee8)
- ignore httpOnly and domain configuration options for resume cookies (952d68e), closes #574
- handle DPoP htu validation when mounted in express (f34526c), closes #572
- use sha512 for Ed25519 and shake256 for Ed448 ID Token
*_hash claims (fd3c9e9)
- autosubmit logout when there’s no accountId in the session (c6b1770), closes #566
- omit
*_hash ID Token claims if signed with “none” (code flow only) (5c540c0)
- add interaction<>session consistency checks (018255e)
- update DPoP implementation to indivudal draft 03 (a7f5d7d)
- respect mountPath when rendering device flow html views (74b434c), closes #561
- typescript: add findByUserCode to DeviceCode types (df58cff)
- remove registration access token when client is deleted (e24ad4a), closes #555
- typescript: allow registration policies type to be async (0a46a65), closes #551
- cookies: use ctx.secure from the mount context when available (c8d8fe6)
- mounted devInteractions now honour the mount path (8fb8af5), closes #549 #548
- typescript: add missing OIDCContext cookies property (0c04af6)
- forbid redirect_uri with an empty fragment component (ca196a0)
- v6.12.6 native app uris regression fixed (fd56ef6)
- typescript: revert void/undefined changes from 6.12.3 (e0bbaae), closes #541
- use updated jose package (ee17022)
- typescript: fix void/undefined inconsistencies and ts lint (96c9415)
- do not send empty secret to adapter in a DCR edge case (af9ecd9)
- fixed session management state fallback cookie name (91b0dea)
← Newer entries | Older entries →
