- allow koa context argument in idFactory and secretFactory (76aa942), closes #455
- set samesite compatibility cookie as transient when the session is (1257164), closes #636
- allow ECDH-ES with AES_CBC_HMAC_SHA2 key sizes larger than 256 bits (a65e9c4)
- allow overloading prototype for comparing client secrets (eec36eb), closes #631
- number of default should-change notices using a wrong property (8e51724)
- principal-change triggered logout fixes (fa860cf), closes #628 #600
- fix client secret based algorithm keys for clients with jwks (75d82a0)
- update PAR implementation to an ietf WG draft version (d3a772b)
- typescript: rotateRefreshToken boolean, ES256K, async customizers (22ab1e3)
- skip JWT validating iat is in the past when exp is present (a7dd855)
- properly handle routes ending with a trailing slash (again) (d8a3a67)
- properly handle routes ending with a trailing slash (c4b06de)
- allow empty body without content-type on userinfo (d5148ad)
- forbid “none” id token algorithm when backchannel logout is used (797919e)
- registered native loopback redirect_uris do not get normalized (96e035f)
- add support for secp256k1 elliptic curve use (30aa706)
- use shake256(m, 114) for Ed448 ID Token
*_hash claims (7e6ba6f)
- add script tag nonce resolution helper for session management and wmrm (#584) (b32b8e6), closes #583
- ensure BaseModel descendants have an exp property (22cc547), closes #580
- regression introduced in 58f7348 (4738a8b)
- add jwsreq Accept value to request_uri resolver (cec4016)
- expose client schema invalidate(err, code) to enable customization (d672ee8)
- ignore httpOnly and domain configuration options for resume cookies (952d68e), closes #574
- handle DPoP htu validation when mounted in express (f34526c), closes #572
- use sha512 for Ed25519 and shake256 for Ed448 ID Token
*_hash claims (fd3c9e9)
- autosubmit logout when there’s no accountId in the session (c6b1770), closes #566
- omit
*_hash ID Token claims if signed with “none” (code flow only) (5c540c0)
- add interaction<>session consistency checks (018255e)
- update DPoP implementation to indivudal draft 03 (a7f5d7d)
- respect mountPath when rendering device flow html views (74b434c), closes #561
- typescript: add findByUserCode to DeviceCode types (df58cff)
- remove registration access token when client is deleted (e24ad4a), closes #555
- typescript: allow registration policies type to be async (0a46a65), closes #551
- cookies: use ctx.secure from the mount context when available (c8d8fe6)
- mounted devInteractions now honour the mount path (8fb8af5), closes #549 #548
- typescript: add missing OIDCContext cookies property (0c04af6)
← Newer entries | Older entries →
