All notable changes to this project will be documented in this file. See standard-version for commit guidelines.
4.3.0 (2021-01-22)
- typescript: add userinfo response generics (b176b2f)
4.2.3 (2021-01-18)
- use base64url encoding in node when available (24ab5b4)
4.2.2 (2020-11-30)
4.2.1 (2020-10-27)
4.2.0 (2020-10-03)
4.1.1 (2020-09-14)
4.1.0 (2020-09-11)
- OAuth 2.0 DPoP in various relevant API interfaces (44a0de7)
4.0.2 (2020-09-11)
- updated request object mime-type as per draft-ietf-oauth-jwsreq-30 (d5cc619)
4.0.1 (2020-09-10)
- ensure minimal got version handles upcoming node version changes (fd737a3)
4.0.0 (2020-09-09)
- the deprecated
issuer.key()method was removed - due to added ESM module support Node.js version with
ESM implementation bugs are no longer supported, this only affects early
v13.x versions. The resulting Node.js semver range is
^10.19.0 || >=12.0.0 < 13 || >=13.7.0(also taking into account thegotdependency update) - upgraded got http request library dependency from
v9.xtov11.x. If you override some of the http request options you will most certainly have to accomodate them. - Signed Request Object "typ" changed from
JWTtooauth.authz.req+jwt - Encrypted Request Object "cty" changed from
JWTtooauth.authz.req+jwt - PKCE is now used by default in the passport strategy
client.userinfo()verbparameter was renamed tomethod- the deprecated
client.resource()method was removed
- added support for ESM (ECMAScript modules) (3ac37e8)
- passport strategy will now use PKCE by default where applicable (56f9fe7)
- request object type changed from 'JWT' to 'oauth.authz.req+jwt' (641a42f)
- remove deprecated
client.resource()(c0ec865) - remove deprecated
issuer.key()(5cd1ecf) - rename
client.userinfo()verbparameter tomethod(4cb21a4) - upgrade got from v9.x to v11.x (c72b5e8)
3.15.10 (2020-09-02)
3.15.9 (2020-07-26)
3.15.8 (2020-07-17)
- allow AAD appid including discovery URLs to be multi-tenant (c27caab)
3.15.7 (2020-07-16)
3.15.6 (2020-07-06)
- merge helper returns modified object, leftovers removed (2e3339b)
3.15.5 (2020-06-26)
3.15.4 (2020-06-26)
3.15.3 (2020-06-15)
3.15.2 (2020-06-01)
3.15.1 (2020-05-12)
- A192CBC-HS384 and A256CBC-HS512 direct encryption key derivation (c356bbe)
3.15.0 (2020-04-28)
3.14.2 (2020-04-07)
- typescript: add options arg to TypeOfGenericClient (b97b028)
3.14.1 (2020-03-21)
- assert refresh_token grant ID Token sub to equal previous (23f3f9f)
3.14.0 (2020-02-28)
3.13.0 (2020-02-18)
- add support for RSA-OAEP-384 and RSA-OAEP-512 JWE algorithms (6c696e9)
3.12.2 (2020-01-30)
- ensure jose version that handles ECDH-ES for larger key sizes right (e91001a)
3.12.1 (2020-01-25)
- allow multiple keys to match when selecting encryption key for request object (fa3fa67)
3.12.0 (2020-01-23)
- allow omitting the
*_encattributes (default 'A128CBC-HS256') (6567c73)
3.11.0 (2020-01-10)
- typescript: allow 'id_token token' as a response type (61c486c)
3.10.1 (2020-01-07)
- allow duplicate "kid" values in issuer's jwks_uri (sigh) (8840fb6)
3.10.0 (2019-12-27)
- enabled full JWT validation on distributed and aggregated claims (d95e31b)
- allow consuming JARM responses (jwt response mode) (dd4aae9)
3.9.2 (2019-12-17)
- skip validating iat is in the past (0791001)
3.9.1 (2019-12-15)
- remove check for nonce presence in params (cac46fb)
3.9.0 (2019-12-06)
- check for mTLS request options during token_endpoint calls (269569f)
- typescript: complete http options (3997687)
- added API for fetching any resource (ae242a5)
- added issuer.FAPIClient for FAPI RW integrations (ab88aa5)
3.8.4 (2019-11-26)
- use shake256(m, 114) for Ed448 ID Token _hash claims (80311c8)
3.8.3 (2019-11-14)
3.8.2 (2019-11-10)
- assert jwks is present for private_key_jwk first (c1f875c)
3.8.1 (2019-11-07)
- use sha512 for Ed25519 and shake256 for Ed448 ID Token _hash claims (31f7a04)
3.8.0 (2019-11-07)
- allow tokenType for userinfo to use as authorization header scheme (4eaa75f)
3.7.4 (2019-10-24)
3.7.3 (2019-10-01)
- use updated jose package (1f3a251)
3.7.2 (2019-09-13)
3.7.1 (2019-09-09)
- typescript: remove the need for @types/got dependency (e5a50d7)
3.7.0 (2019-09-09)
- assert client_secret is present when required, require client_id, etc (82855a5)
- Add Typescript definitions (#184) (c37130b)
- allow clientAssertionPayload to overwrite default payload (28c8964)
3.6.2 (2019-09-03)
- device authorization request always pushes the client_id to body (6fbf125)
3.6.1 (2019-08-24)
- ignore runtime unsupported or malformed issuer jwks (f08b8be)
3.6.0 (2019-08-24)
- add RFC8628 - OAuth 2.0 Device Authorization Grant (Device Flow) support (adb4b76)
- allow multiple resource parameters in authorization requests (dfdd8cb)
3.5.0 (2019-08-22)
- added Node.js lts/dubnium support for runtime supported features (54788c2)
3.4.0 (2019-08-13)
- electron v6.x runtime support (65ec619)
3.3.0 (2019-08-02)
- option to change http options globally (a1e0a3f)
3.2.3 (2019-07-18)
3.2.2 (2019-07-12)
3.2.1 (2019-07-10)
- plug reported lodash vulnerability (b690dac)
3.2.0 (2019-06-27)
- feat: added support for direct symmetric key encryption alg (dir) (f1b4282)
3.1.2 (2019-06-21)
- ensure runtime @panva/jose dependency ^1.3.0 (d992deb)
3.1.1 (2019-05-15)
3.1.0 (2019-05-13)
- add helpers for generating secure random values & PKCE challenges (44f1865)
3.0.0 (2019-05-11)
- authorizationParams no longer requires nonce for
response_type=token - issuer's auth signing algs presence is now asserted if client is missing the relevant metadata property
- unintended (client|issuer).metadata[property] reassignment is no longer possible
- refreshed encrypted ID Tokens are now properly decrypted
- userinfo_endpoint presence on an issuer is now asserted during userinfo function call
- PBES2 symmetric encryption and decryption now correctly uses the
client_secretvalue rather then its SHA digest - Accept header is now correctly set for all requests
- clients configured to receive signed and/or encrypted userinfo endpoints will now correctly reject
a response that isn't proper
application/jwt
- Typed Errors - openid-client now has unique errors for HTTP transport related errors, OP/AS returned errors and RP(client-side) assertions.
- common configuration issues are now gracefully handled. I feel like many developers may be
setting properties like
redirect_uriorresponse_typeon a client instance. I sympathize and openid-client will now take these common mistakes and accomodate. - QoL
#client.authorizationParams()will now attempt to resolve theredirect_uriandresponse_typefrom your client's metadata. If there's only one listed, it will be used automatically. If there's more, you must continue providing it explicitly. - per-request http request options helper function HTTP request options can now be modified on a per request basis for the different classes or their instances. This now allows each request's options to be altered on-demand with e.g. client mutual-TLS certificates or implementing work arounds for specific AS quirks.
- mutual-TLS client authentication is now supported through the above mentioned helper for both client-authentication and proof-of-possession purposes.
- custom request bodies Where the above per-request helper falls short is providing extra
token endpoint exchange parameters like
resourceto authorization code or refresh token exchange, you can now pass those in the actual client methods. - custom client assertion payloads You can now pass extra claims to the client authenticated calls e.g. token, introspect, revoke.
- request objects are now set to be one-time use Generated Request Objects are secure by default they include iat, exp and jti claims so that OPs have a way to make them one-time use depending on their policy.
- EdDSA support OKP JSON Web Keys and EdDSA signing and verification is now supported.
- openid-client now uses
@panva/josefor all things JOSE. As a result of this the minimum required node version is v12.0.0 and the client will now only function in node.js environments. Issuer.defaultHttpOptionsgetter and setter were removed. See documentation customization section for its replacement.client.CLOCK_TOLERANCEclient property was removed. See documentation customization section for its replacement.client.authorizationCallback()has been renamed toclient.callback()tokenset.claimsgetter is now a functiontokenset.claims()useRequestanduseGotmethods were removed, with the maintenance mode and inevitable deprecation of therequestmodule i've decided to only support got as an http request library.- Instead of passing jose library keystore instances with private keys the API now
expects a JWKS formatted object.
keystoreoptions argument properties are now called justjwks. response_type=codeis no longer defaulted to in#client.authorizationUrl()if your client instance has multipleresponse_typesmembers.- Strict
===equality operator is now used for assertions, while unlikely the breaking change is that should some ID Token claims be correct values but incorrect type, these will start failing now. #client.revoke()no longer returns or in any way processes the response body as per spec requirements.- All http(s) responses are now strictly checked for the expected http response status code.
- All http(s) requests now assert that an absolute URL is being requested.
- Passport Strategy will now fail when userinfo is requested via the verify callback arity but no access token is returned from the OP.
2.5.0 (2019-04-29)
2.4.5 (2018-11-05)
- upgrade min node-jose version to fix its performance in node (e682dfc)
2.4.4 (2018-10-18)
- strategy code_verifier length, removed uuid dependency (60d0cb8...ea4a8fd), closes #131
2.4.3 (2018-10-10)
- assign Discovery 1.0 defaults when discovering with .well-known (74b593e)
2.4.2 (2018-09-27)
2.4.1 (2018-09-16)
- lts/boron unsupported syntax fix (5289188)
2.4.0 (2018-09-16)
- OpenIdConnectError also returns session_state (95fae3d)
- stop sending state on the authorisation code token grant (c4c9e50)
2.3.1 (2018-08-23)
- apply safer, simpler www-authenticate parsing regex (ffce55a)
- only assign Discovery 1.0 defaults when Issuer is discovered (dca60b8)
2.3.0 (2018-08-11)
- authorization response parameter checking based on response_type (6e0ac57)
- passport strategy automatically checks response REQUIRED params (902eeed)
- 2018-07-10 DIFF
- improved discovery support of custom .well-known suffixes
- chores - refactoring, missing tests, cleanup
- 2018-07-04 DIFF
- added support for RFC8414 - OAuth 2.0 Authorization Server Metadata discovery
- 2018-06-28 DIFF
- fixed handling of bearer endpoint responses with www-authenticate headers only. fixes #102
- 2018-05-31 DIFF
node-josedependency bumped to major ^1.0.0 - fixesA\d{3}GCMKWsymmetrical encryption support- dependency updates
- 2018-05-25 DIFF
- fixed circular when serializing OpenIdConnectError
- base64url dependency update
- 2018-05-15 DIFF
- base64url dependency replaced
- 2018-05-10 DIFF
- dependency tree updates
- 2018-04-26 DIFF
- fixed
client_secret_basicrequiring the username and password tokens to bex-www-form-urlencodedaccording to https://tools.ietf.org/html/rfc6749#section-2.3.1- NOTE: Although technically a fix, this is a breaking change when used with providers that also
don't currently follow the standard. A proper way of submitting client_id and client_secret using
client_secret_basicisAuthorization: base64(formEncode(client_id):formEncode(client_secret)). If your client_id and client_secret does contain special characters that need encoding this does not affect you. If it does, try usingclient_secret_postinstead.
- NOTE: Although technically a fix, this is a breaking change when used with providers that also
don't currently follow the standard. A proper way of submitting client_id and client_secret using
- 2018-04-12 DIFF
- dropped support for Node.js v4.x due to its End-of-Life on 2018-04-30
- removed deprecated
client#grantAuth - removed deprecated way of passing keystore directly to
Client#register - removed support for passing client to
OpenIDConnectStrategyas single argument, usenew Strategy({ client })instead ofnew Strategy(client). - fixed a bug requiring nonce to be passed for
response_type=none
- 2018-03-13 DIFF
- added documentation for
OpenIdConnectError - added
error_urifrom IdP responses toOpenIdConnectErrorinstances - fixed
OpenIdConnectErrormessages to includeerror_description
- 2018-03-10 DIFF
Issuer.discovernow parses the provided URI instead of just inspecting the string. #80
- 2018-01-30 DIFF
- fixed edge cases of (and simplified) private id token decryption method
- 2018-01-22 DIFF
- fix return values of
#authorizationCallback()forresponse_type=noneto resolve a TokenSet
- 2018-01-16 DIFF
- fixed
authorizationUrlto respect existing issuer authorization_endpoint query parameters
- 2018-01-15 DIFF
- adjusted the passport state mismatch related error message to hint developers at a local setup issue
- 2017-12-12 DIFF
- added maintained request wrapper and a simple api to use request instead of
got
- 2017-12-05 DIFF
- bumped node-jose dependency
- 2017-11-25 DIFF
- fixed the order of several
assert.equalcalls to swap actual/expected descriptions - added assertion error messages for passport strategy
- 2017-11-19 DIFF
- added option for the passport strategy to use PKCE
- updated http request library
gotdependency
- 2017-10-31 DIFF
- now uses
client_secret_postas default for Issuer instances that do not supportclient_secret_basicbut do signal support forclient_secret_postin their discovery document
- 2017-10-13 DIFF
- added
s_hashvalue validation support for ID Tokens returned by authorization endpoint - fixed edge cases where valid
_hashbut from invalid sha-length was accepted
- 2017-09-11 DIFF
- added support for Request Objects encrypted with symmetrical keys
- fixed PBES2 encryption to use client_secret derived symmetrical key instead of its full octet value
- 2017-09-09 DIFF
- added Passport Strategy
passReqToCallbackoption, defaults to false
- 2017-08-24 DIFF
- added an optional keystore argument to
Client#fromUri(uri, token, [keystore])to pass a keystore with private asymmetrical keys - fixed keystore check during constructor
Client#newcalls to check that only private asymmetrical keys are added
- 2017-08-11 DIFF
- explicitly specified accepted response type via
accept: application/jsonheader - added state to token_endpoint calls for servers supporting mixup mitigation
- 2017-07-17 DIFF
- Allow session key to be specified in passport strategy options
- 2017-07-14 DIFF
- relaxed #callbackParams to allow IncomingMessage lookalikes
- update internal dependencies
- 2017-05-19 DIFF
- fixed default application_type from
['web']to'web' - added barebones
Issuer.httpClientsetter to help advanced developers in complex environments to change the used http request client
- 2017-05-04 DIFF
- added pure OAuth 2.0 stripped down callback function
#oauthCallback - added an extra option for
#userinforequests to have extra params in either query or body
- 2017-04-30 DIFF
- added introspection/revocation specific client and issuer properties. To remain backwards
compatible they default to their token endpoint counterparts
- issuer.revocation_endpoint_auth_methods_supported
- issuer.introspection_endpoint_auth_methods_supported
- issuer.revocation_endpoint_auth_signing_alg_values_supported
- issuer.introspection_endpoint_auth_signing_alg_values_supported
- client.revocation_endpoint_auth_method
- client.introspection_endpoint_auth_method
- client.revocation_endpoint_auth_signing_alg
- client.introspection_endpoint_auth_signing_alg
- 2017-04-29 DIFF
- bumped node-jose dependency to avoid github tar.gz dependencies
- adjusted token_endpoint_auth_method=none to how it should be
- 2017-04-07 DIFF
- Issuer and Client now recognize custom properties, this is so that new Registry Contents do not
require a new release of openid-client to be picked up. Custom properties are exposed as getters
so long as they do not interfere with the object's Prototype and they are always available in
#metadatagetter.
- 2017-03-28 DIFF
- added missing check for webfinger issuer location protocol
- 2017-03-28 DIFF
- added authorizationCallback support for submitting code_verifier
- example now includes session management OP and RP frames
1.7.0 failed to publish properly, use 1.7.1 instead
- 2017-03-14 DIFF
- fixed receiving (correct) empty responses from revocation endpoints (#21)
- 2017-03-14 DIFF
- bumped minimum node-jose version to cover http://blog.intothesymmetry.com/2017/03/critical-vulnerability-in-json-web.html
- 2017-03-09 DIFF
- fixed verify callback skipping userinfo when userinfo_endpoint is not configured (#19)
- removed mandatory checks from passport strategy, allowing i.e. implicit only OPs (#19)
- 2017-03-07 DIFF
- fixed verify callback skipping userinfo call when arity says it should but no access token is present (#18)
- 2017-02-15 DIFF
- added at_hash presence assertion for applicable (implicit) ID Token validation
- added c_hash presence assertion for applicable (hybrid) ID Token validation from the authorization_endpoint
- 2017-02-15 DIFF
- fixed an ID Token validation for ID Token returned by Token Endpoint that includes c_hash
- 2017-02-01 DIFF
- fixed passport strategy, have it use prototype instead of ES6 class syntax
- 2017-01-29 DIFF
- fixed client_assertion aud claim for
_jwtauth methods when used in introspection and revocation
- 2017-01-26 DIFF
- added a passport.js strategy
- added missing max_age, default_max_age related functionality
- authorizationCallback now supports max_age check
- clients with default_max_age use this default value automatically
- when max_age is checked auth_time claim is mandatory and must be a number
- added missing require_auth_time related functionality
- clients with require_auth_time = true have the presence and format of auth_time claim validated
- authorizationUrl and authorizationPost now removes null and undefined values and ensures parameters are stringified before passed to url.format
- added client.CLOCK_TOLERANCE property, to allow for clock skew (in seconds)
- 2017-01-10 DIFF
- deprecated passing keystore directly to Client#register, pass an object with keystore property instead
- added the option to provide InitialAccessToken value to Client#register
- 2016-12-18 DIFF
- added error messages when expected response is missing
- 2016-12-13 DIFF
- added
#requestObjectmethod to Client to return signed and/or encrypted Request Object
- 2016-12-09 DIFF
- added
#claimsgetter to TokenSets returned fromauthorizationCallbackandrefresh;
- 2016-11-23 DIFF
- fixed unpacking aggregated claims with alg=none and no iss claim
- fetching distributed claims now expects a JWT response, previously expected invalid OP responses
- 2016-11-22 DIFF
- fixed signed userinfo response validation in case iss, aud and similar ID Token claims are missing
- 2016-11-18 DIFF
- Updated uuid dependency
RP test tools are passing, no changes required from the library, API is declared stable, hence 1.0.0 release.
- 2016-11-16 DIFF
- See 1.x migration to update your 0.x deployment into 1.x.
- update your package.json file to
"^1.0.0" - sit back and relax, no breaking changes
4. Major version zero (0.y.z) is for initial development. Anything may change at any time.
The public API should not be considered stable.
5. Version 1.0.0 defines the public API.
- https://github.com/panva/node-openid-client/compare/v0.6.0...v0.7.0
- added: webfinger discovery
- added: callback parameter helper for node's http.IncomingMessage
- tested for lts/argon (4), lts/boron (6) and current stable (7)
- https://github.com/panva/node-openid-client/compare/v0.5.4...v0.6.0
- added: handling of symmetrically encrypted responses (A...GCMKW, A...KW, PBES2-HS...+A...KW)
- fix: state check supersedes error check, still not sure about it though
- https://github.com/panva/node-openid-client/compare/v0.5.0...v0.5.4
- added: token_type_hint for introspection and revocation
- fix: handle refresh w/o id_token
- fix: ignore nonce values when refreshing w/ id_token
- fix: validateIdToken only checks at_hash and c_hash values when TokenSet is passed in
- fix: session_state now part of returned TokenSet
- https://github.com/panva/node-openid-client/compare/v0.4.1...v0.5.0
- aggregated and distributed claim handling
- https://github.com/panva/node-openid-client/compare/v0.3.0...v0.4.1
- fix: issuer with path component discovery
- built-in signed and/or encrypted userinfo handling
- authorizationCallback handling of implicit and hybrid responses
- https://github.com/panva/node-openid-client/compare/v0.2.0...v0.3.0
- encrypted userinfo and idtoken response handling
- https://github.com/panva/node-openid-client/compare/v0.1.0...v0.2.0
- httpOptions configurable on a library level
- signed userinfo response handling