v6.9.0

Features

• added TypeScript definitions (#530) (5adf5a8)

v6.8.0

Features

• update fapiRW draft feature (8b927fc)
• update pushed request objects to b6cd952 (43fa8aa)

v6.7.0

Bug Fixes

• correct ssl offloading proxy documentation url in console warning (b871e99)
• handle server_error on expired unsigned request objects (7172a85)
• ignore secret and expiration timestamp on dynamic create (edge case) (d532fb2)

Features

• allow authorization requests with only a Request Object (e3fa143)
• allow structured access token customizations (4be3bb2), closes #520
• experimental support for pushed request objects (4ac3905)
• strategies for parameter merging Request Object <> OAuth 2.0 (3ad1744)
• support non-0 expiring client secrets (client_secret_expires_at) (02877f6)

v6.6.2

Bug Fixes

• do not use mounted app's ctx.cookies (ce0c06d), closes #517

v6.6.1

Bug Fixes

• extend interactionDetails to allow (req, res) (e1d69cf), closes #517

v6.6.0

Bug Fixes

• properly apply samesite=none for non-webkit browsers (ec2ffc6)

Features

• added Node.js lts/dubnium support (52e914c)

v6.5.0

Bug Fixes

• empty params are handled as if they were not provided at all (a9e0f8c)

Features

• basic and post client auth methods are now interchangeable (a019fc9)
• enable RSA-OAEP-256 when node runtime supports it (cfada87)
• new experimental support for FAPI RW Security Profile added (0c69553)
• RFC8628 has been published, device flow is now a stable feature (98a3bd4)

v6.4.2

Bug Fixes

• make structured token's end-user "sub" pairwise if configured (24a08c2)
• use correct postLogoutRedirectUri for resume's logout when mounted (a72b27d)

v6.4.1

Bug Fixes

• bring paseto token claims inline with jwt-ietf (265e400)

v6.4.0

Bug Fixes

• paseto formatted access token audience is a single string (1fd45f5)
• properly check if resourceIndicators is enabled (bbcdca2)

Features

• added a helper for validating provided resource indicator values (a97ffdc), closes #487
• allow audiences helper to return a single string audience (4c7a3a8)
• draft implementation of IETF JWT Access Token profile (e690462)