- forbid redirect_uri with an empty fragment component (ca196a0)
- v6.12.6 native app uris regression fixed (fd56ef6)
- typescript: revert void/undefined changes from 6.12.3 (e0bbaae), closes #541
- use updated jose package (ee17022)
- typescript: fix void/undefined inconsistencies and ts lint (96c9415)
- do not send empty secret to adapter in a DCR edge case (af9ecd9)
- fixed session management state fallback cookie name (91b0dea)
- handle sameSite=none incompatible user-agents (4e68415)
- typescript: provider.callback getter type regression fixed (5cea116), closes #534
- token TTL being a helper function is now accepted (a930355)
- default refresh token TTL policy for SPAs follows the updated BCP (d6a2a34)
- update JWT Response for OAuth Token Introspection to draft 08 (5f917e2)
- update FAPI RW behaviours (a7ed27a)
- update pushed authorization requests draft (aaf5740)
- update fapiRW draft feature (8b927fc)
- update pushed request objects to b6cd952 (43fa8aa)
- correct ssl offloading proxy documentation url in console warning (b871e99)
- handle server_error on expired unsigned request objects (7172a85)
- ignore secret and expiration timestamp on dynamic create edge case (d532fb2)
- allow authorization requests with only a Request Object (e3fa143)
- allow structured access token customizations (4be3bb2), closes #520
- experimental support for pushed request objects (4ac3905)
- strategies for parameter merging Request Object <> OAuth 2.0 (3ad1744)
- support non-0 expiring client secrets (client_secret_expires_at) (02877f6)
- do not use mounted app’s ctx.cookies (ce0c06d), closes #517
- extend interactionDetails to allow (req, res) (e1d69cf), closes #517
- properly apply samesite=none for non-webkit browsers (ec2ffc6)
- added Node.js lts/dubnium support (52e914c)
- empty params are handled as if they were not provided at all (a9e0f8c)
- basic and post client auth methods are now interchangeable (a019fc9)
- enable RSA-OAEP-256 when node runtime supports it (cfada87)
- new experimental support for FAPI RW Security Profile added (0c69553)
- RFC8628 has been published, device flow is now a stable feature (98a3bd4)
- make structured token’s end-user “sub” pairwise if configured (24a08c2)
- use correct postLogoutRedirectUri for resume’s logout when mounted (a72b27d)
- bring paseto token claims inline with jwt-ietf (265e400)
- paseto formatted access token audience is a single string (1fd45f5)
- properly check if resourceIndicators is enabled (bbcdca2)
- added a helper for validating provided resource indicator values (a97ffdc), closes #487
- allow audiences helper to return a single string audience (4c7a3a8)
- draft implementation of IETF JWT Access Token profile (e690462)
- new option for resolving JWT Access Token signing algorithm (28e85ef)
- do not assign the defaulted to response_mode to params (18867ad)
- dynamic format gets a ctx as a first argument as documented (f62eb4b)
- bump dependencies and compatible draft versions (97738e3)
- revert missing mTLS cert errors to invalid_grant (afac459)
- mTLS stable release candidate (a999452)
- acknowledging tls client auth draft fixed (02df82a)
- bump acknowledgable draft versions that don’t need code changes (55b4770)
- authorization header scheme is checked case-insensitive (773ec52)
- block static client registration read action (edgiest of cases) (18db430)
- update dependencies, plug reported lodash vulnerability (a2cdfd0)
- add experimental support for DPoP (61edb8c)
- default renderError page escapes error props inherited from params (6aedbab), closes #489
- device flow refresh tokens for public clients are now be certificate bound as well (904ad2d)
- correctly apply mergeWithLastSubmission for interactionFinished (eb67723)
← Newer entries | Older entries →
